Case · DiggingBeagle record
An opt-in experimental tasks feature in the MCP Python SDK used task identifiers without checking which session created them, allowing other clients to inspect or cancel tasks.
CVE-2026-52870 applies only to applications that enabled the low-level experimental tasks feature. It does not describe every MCP Python SDK deployment.
The defect was ordinary authorization inside an agent protocol feature. Experimental task handlers accepted a task ID as enough authority for list, get, result and cancel operations. In a multi-client server, the SDK did not record and enforce which session owned the task.
That matters because asynchronous agent work often contains long-lived results, prompts and elicitation state. A task identifier can be guessed, discovered or leaked; it should not become a bearer credential unless the protocol explicitly designs it that way.
The advisory is tightly scoped. Applications that never enabled the experimental tasks feature were not affected. Version 1.27.2 is listed as the fix.
Experimental tasks create a long-lived task identifier.
Boundary: client / task store
Affected handlers can later resolve the task by identifier alone.
Boundary: task identity / authorization
A different connected client can list, read results from or cancel the task.
Boundary: session A / session B
The MCP Python SDK advisory documents the experimental-task authorization flaw.
The reviewed advisory record was updated in July.
Locator: Summary and details
The advisory states that task handlers acted on task identifiers without creator-session ownership checks.
Locator: Patched versions
The advisory lists 1.27.2 as patched.
Locator: Affected versions and Am I affected?
The advisory scopes the issue to servers calling server.experimental.enable_tasks(), with 1.27.2 as the patched version.
diagram
Creates an experimental task
Task ID stored without creator-session ownership check
Uses list/get/result/cancel against another client's task
Agent protocols need object-level authorization for asynchronous work. Session ownership should be explicit at creation and enforced at every subsequent operation.
DiggingBeagle. “MCP Python SDK tasks crossed client-session boundaries.” First seen Jun 5, 2026. https://diggingbeagle.com/cases/mcp-python-sdk-tasks-crossed-client-session-boundaries/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.