Tracking: CVE-2026-55604
Severity: High
Who is affected
@arikusi/deepseek-mcp-server from 1.4.2 to before 1.7.0. The reported HTTP flow allows a caller to enumerate sessions and reuse a selected identifier.
How the attack works
A global session store trusts the client's session_id without binding it to an authenticated owner. deepseek_sessions exposes session identifiers, and a subsequent deepseek_chat call can select one belonging to another user.
That lets the caller read conversation history and continue or alter the session. An identifier that selects stored state is not an authorization check, even if the identifier is difficult to guess.
What to do
- Upgrade to 1.7.0 or later for the session-isolation fix. For self-hosted HTTP deployments, use 1.8.0 or later to also address CVE-2026-55605.
- Review session enumeration and chat requests for reuse across unrelated callers. Assess sensitive information included in affected conversations.
- Verify that application access controls bind stored sessions to their legitimate users, rather than relying on client-supplied IDs.
Scope and limits
The related authentication and authorization findings have different fixed versions. Both matter when choosing a safe deployment baseline.