CVE-2026-79537 in MetaMCP
Summary
by MITRE • 09/29/2026
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the per-endpoint authorization middleware validates only the URL endpoint's owner, never the session. An attacker who supplies another tenant's session id " obtained without authentication from GET /metamcp/health/sessions, which discloses active session IDs and namespace UUIDs " can list and execute the victim tenant's private MCP tools and exfiltrate their data using the victim's forwarded credentials.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in MetaMCP versions through 2.4.22 represents a critical failure in access control mechanisms, specifically classified as an Insecure Direct Object Reference or IDOR within the Model Context Protocol transport session dispatch logic. This flaw stems from a fundamental architectural oversight where the system relies exclusively on a client-supplied identifier, the mcp-session-id header, to retrieve and validate active sessions via the getSession function located in session-lifetime-manager.ts. The implementation fails to bind this session identifier to any specific owner identity, namespace context, or endpoint ownership constraints during the retrieval process. Consequently, the session store operates as an unauthenticated lookup table where possession of a valid session ID is sufficient to assume control over that session's privileges and data access rights, completely bypassing standard multi-tenant isolation boundaries.
The operational impact of this vulnerability is severe due to the combination of weak session management and information disclosure in related endpoints. The system exposes active session identifiers and associated namespace UUIDs through an unauthenticated GET request to /metamcp/health/sessions. This public availability allows any external actor, without prior authentication or authorization, to enumerate valid session tokens belonging to legitimate tenants within the platform. By harvesting these session IDs from this health check endpoint, an attacker can directly inject them into subsequent API requests targeting MCP tools and data resources. Because the per-endpoint authorization middleware only validates that the requesting user owns the target URL endpoint but fails to verify that the active session associated with the request belongs to that same owner, the system effectively trusts any valid session ID regardless of its origin or ownership context.
This architectural deficiency enables a complete compromise of tenant isolation and data confidentiality. An attacker who has obtained another tenant's session identifier can list all private Model Context Protocol tools available to that victim tenant and execute them with full administrative privileges granted by the stolen session credentials. Since MCP tools often interact directly with external APIs, databases, or sensitive business logic using forwarded authentication headers provided during the initial session establishment, the exploitation of this IDOR allows the attacker to exfiltrate proprietary data, manipulate system states, or perform actions on behalf of the victim tenant. The lack of namespace binding means that cross-tenant attacks are trivially executed without needing to bypass complex security controls, as the core assumption that a session ID uniquely identifies an authorized user context is fundamentally broken.
From a standards perspective, this vulnerability aligns with CWE-639, which describes authorization issues related to indirect object references where access control relies on untrusted input values like identifiers rather than verified ownership relationships. It also maps directly to MITRE ATT&CK technique T1078, specifically the Valid Accounts sub-category, as it involves the misuse of legitimate credentials or session tokens obtained through improper means such as enumeration from insecure endpoints. The failure to implement proper object-level authorization checks constitutes a classic IDOR scenario where the system fails to ensure that the actor requesting access is authorized for the specific resource identified by the indirect reference.
To mitigate this vulnerability, immediate remediation efforts must focus on enforcing strict ownership validation at every stage of session and request processing. First, the getSession function in session-lifetime-manager.ts must be updated to validate not only the existence of the session ID but also its association with a verified user identity or tenant namespace that matches the context of the current request. Second, the per-endpoint authorization middleware requires enhancement to perform cross-validation between the authenticated owner derived from the session and the resource being accessed, ensuring that users can only interact with resources explicitly owned by their own tenant entity. Additionally, the /metamcp/health/sessions endpoint must be secured behind authentication requirements or restricted to internal monitoring systems only to prevent the enumeration of active session identifiers. Implementing these changes will restore proper multi-tenant isolation and ensure that access decisions are based on verified ownership rather than mere possession of a session token.