Summary
MetaMCP contains an insecure direct object reference in MCP transport session dispatch, allowing session identifiers to be used without verifying tenant ownership or endpoint binding. An unauthenticated attacker who obtains another tenant's session ID may access private MCP tools and exfiltrate data through the victim's forwarded credentials.
Affected context
The vulnerability affects MetaMCP deployments using MCP transport sessions through version 2.4.22. Risk arises when session records are retrieved solely by a client-supplied session identifier, while authorization checks validate the requested endpoint owner without confirming that the session belongs to the same tenant or namespace. Exposure is increased when an unauthenticated health or monitoring endpoint discloses active session identifiers and namespace UUIDs.
Exploit preconditions
- Attack surface: MCP transport session dispatch and session-management endpoints
- Required access: Ability to reach the exposed health or session-disclosure endpoint and submit requests to MCP endpoints
- Required information: A valid session identifier associated with another tenant
- Trigger point: Session lookup based on the client-supplied
mcp-session-idheader - Why exploitation is possible: Session ownership, namespace, and endpoint binding are not enforced during dispatch, allowing a valid but foreign session to be used after URL-level authorization
Why this happens
The underlying flaw is an authorization design error in which a security-sensitive object is referenced by a client-controlled identifier without verifying ownership or security-context binding. The session store uses only the supplied session ID as its lookup key, while middleware authorizes the endpoint owner rather than the session owner. This maps to CWE-639: Authorization Bypass Through User-Controlled Key, because access decisions rely on a user-controlled reference without enforcing tenant, namespace, or endpoint relationships.
Potential impact
- An attacker may list or invoke another tenant's private MCP tools.
- Confidential tenant data could be exposed or exfiltrated.
- Victim-associated forwarded credentials may be misused through authorized tool execution.
- Cross-tenant isolation could be bypassed.
- Integrity of connected systems or data may be affected through unauthorized tool operations.
General mitigation guidance
Mitigation generally focuses on binding every session to an authenticated security context and enforcing that binding throughout request dispatch.
Common defensive patterns include:
- Associate sessions with an authenticated principal, tenant, namespace, and authorized endpoint set.
- Verify session ownership and context before permitting tool discovery or execution.
- Use opaque, high-entropy session identifiers and treat them as references rather than authorization evidence.
- Avoid exposing active session identifiers or namespace identifiers through unauthenticated diagnostic endpoints.
- Apply least privilege to forwarded credentials and restrict the tools available to each tenant.
- Fail closed when session, tenant, namespace, or endpoint relationships are missing or inconsistent.
How teams detect issues like this
Organizations can detect related authorization weaknesses through:
- Static analysis and code review of session lookups keyed only by request headers or URL parameters.
- Review signals showing authorization of a route or endpoint without authorization of the referenced object.
- Tests that attempt cross-tenant session reuse, namespace substitution, and endpoint/session mismatches.
- Monitoring for session identifiers appearing in unauthenticated responses, logs, or telemetry.
- Policy enforcement requiring tenant and principal binding for security-sensitive session objects.
- Automated security review tools that flag user-controlled object references without ownership checks.
