AIDEFEND in Action AIA-0108 Validated Research Published: Oct 26, 2026

MCP Python SDK: Task IDs Cross the Session Ownership Boundary

The MCP Python SDK connects AI applications to tools and supports experimental long-running tasks. When a multi-client server enabled the affected default task handlers, another client could list tasks, read results and cancel work without a task-owner check. CVE-2026-52870 was fixed for default generated task IDs in 1.27.2; explicitly supplied IDs and direct TaskStore writes need separate ownership review.

Permission BypassSession IsolationMCP Security
2 applicable AIDEFEND defenses
Source: Experimental task handlers allow any client to access and cancel other clients' tasks 
Author: @maxisbey
Original article: Jun 5, 2026

Threat Analysis

  • Locate is not authorize: default task handlers operated on the supplied task identifier without checking the session that created it. Listing, reading and cancellation are separate operations that each need ownership checks.
  • Two alternative consequences: another client can obtain task data or cancel the work. The graph branches after identifier discovery; a successful read is not required to cancel. No particular LLM, private document type or production victim is established.
  • Read the patch boundary: 1.27.2 embeds a per-session marker in generated run_task IDs and filters the default handlers. Explicit IDs and direct TaskStore writes are not made owner-safe merely by upgrading.

Applicable AIDEFEND Defenses (2)

AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
Very High
Upgrade affected server deployments to SDK 1.27.2 or a later supported fixed build and verify the package loaded by every worker. Exercise two independent clients against list/get/result/cancel, including explicit IDs and direct TaskStore creation. The published patch scopes default generated IDs; if custom-ID paths cannot enforce ownership, replace their handlers or leave experimental Tasks disabled. A version string alone is not closure.
AID-H-034.007
MCP Task & Subscription Lifecycle Isolation
Medium
For a server team maintaining custom task handlers, bind durable tasks to authenticated principal, client and tenant and check ownership separately before every read and cancel. Adapt and test this for the affected legacy list/get/result/cancel methods and custom IDs. Current G001 describes the newer 2026-07-28 Tasks extension, which removes some legacy methods; its example is not a drop-in fix for this SDK. The credited mechanism is the implemented and verified lifecycle ownership gate, with migration or a legacy adapter required.

What Defenders Should Do Now

  • Inventory servers that actually enable experimental Tasks, update them and keep the feature disabled where unused.
  • Test with two real independent client contexts; try list, guessed/copied IDs, get, result, messages and cancel before and after the fix. Include custom IDs and direct store writes.
  • For custom task services, implement authoritative ownership at each handler or migrate to the current Tasks extension with compatibility tests. Never treat an unguessable ID as the entire authorization boundary.

Conclusion

AIDEFEND  separates verified SDK remediation from the task-lifecycle authorization that a custom service must enforce. Keeping every task read and cancellation bound to its legitimate owner addresses this case more directly than adding a login check to an already multi-client server.

Last updated: