GHSA-5p9g-j988-pcwv (mcp): Ruby SSE Session Poisoning
21-Jul-2026 1
Originally appeared on RubySec.## Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - th...
GHSA-5p9g-j988-pcwv (mcp): Ruby SSE Session Poisoning #ruby #rubydeveloper #rubyonrails #ruby #rubyonrails #programming #webdev #ghsa-5p9g-j988-pcwv #(mcp): https://rubyonrails.ba/link/ghsa-5p9g-j988-pcwv-mcp-ruby-sse-session-poisoning