CVE-2026-55604: DeepSeek MCP Server Session Hijacking Vulnerability

Technical summary

The DeepSeek MCP Server's process-global `SessionStore` component fails to bind session identifiers to authenticated principals or transport-layer sessions. The `deepseek_sessions` endpoint leaks enumerable session IDs, and the `deepseek_chat` endpoint accepts caller-supplied `session_id` values without validation against the caller's authenticated identity or connection context. An attacker with network access can enumerate valid session IDs and subsequently issue `deepseek_chat` requests with a victim's `session_id` to access and manipulate the victim's conversation state. The root cause is insufficient authorization checks at the session lookup layer. Version 1.7.0 patches this by binding sessions to authenticated principals.

Business impact

Session hijacking in an AI inference server exposes conversational context that may contain sensitive business logic, proprietary prompts, data analysis results, or private information. An attacker who gains access to a victim's session can read conversation history, extract insights, and in some cases modify ongoing requests. For organizations using DeepSeek MCP Server for internal tool development, data processing, or decision support, this vulnerability poses a confidentiality and integrity risk. The lack of authentication requirement lowers the barrier to exploitation.

Affected systems

DeepSeek MCP Server versions 1.4.2 through 1.6.x are affected. Version 1.7.0 and later include the patch. Organizations running DeepSeek MCP Server in their infrastructure should immediately identify which versions are deployed. The vulnerability applies to the default `SessionStore` implementation and affects any caller that relies on the `deepseek_sessions` and `deepseek_chat` endpoints.

Exploitability

Exploitability is high. The vulnerability requires no authentication, no user interaction, and no special privileges—only network access to the MCP server. An attacker can exploit this in three steps: enumerate session IDs via the unauthenticated `deepseek_sessions` endpoint, identify active/valid sessions, then reuse a victim's session ID in a `deepseek_chat` request. The attack surface is broad because session enumeration is likely available by default. Proof-of-concept code is straightforward HTTP requests; no complex bypass is needed.

Remediation

Upgrade to DeepSeek MCP Server version 1.7.0 or later. The patch introduces session binding to authenticated principals, preventing caller-supplied session IDs from being accepted without validation. Organizations unable to patch immediately should implement network-level access controls to restrict access to the MCP server endpoints to trusted internal services only, and consider disabling the `deepseek_sessions` enumeration endpoint if not required for legitimate use. Monitoring for unusual session reuse patterns can provide temporary detection.

Patch guidance

Verify that your deployed version of DeepSeek MCP Server is 1.7.0 or later. Check the version in your deployment configuration or via the service health/version endpoint. If running 1.6.x or earlier, schedule an upgrade to 1.7.0. Consult the official DeepSeek MCP Server release notes to confirm compatibility with your environment and any dependent integrations. Test in a staging environment before production rollout. Downtime should be minimal as the upgrade is typically a container or package update.

Detection guidance

Monitor access logs for the `deepseek_sessions` endpoint to detect enumeration attempts, particularly bulk requests or repeated failed lookups. Review `deepseek_chat` request logs for anomalies: rapid session switching, requests from unexpected network sources, or session IDs accessed by multiple callers. Implement alerting on authentication mismatches—cases where a request claims a session_id that does not correspond to the authenticated caller identity (post-patch, this should be prevented; pre-patch, cross-referencing authentication tokens with session ownership can reveal hijacking). Collect and correlate session creation timestamps with access logs to identify replayed or reused sessions.

Why prioritize this

This vulnerability earns HIGH priority due to the combination of zero authentication requirements, trivial exploitability, and direct impact on confidentiality and integrity of AI-generated outputs. The attack is undetectable to the victim and requires no sophisticated tooling. Any organization running affected versions in production should prioritize patching within days, not weeks. The CVSS 8.6 score reflects the ease of exploitation and scope of exposure.

Risk score, explained

CVSS 3.1 score 8.6 (HIGH) is driven by: AV:N (network-accessible, no special network positioning required), AC:L (attack complexity is low—enumeration and reuse are straightforward), PR:N (no privileges required), UI:N (no user interaction), S:U (scope is unchanged), C:H (high confidentiality impact—full access to victim conversation history), I:L (low integrity impact—attacker can modify context or steer conversation, but not alter stored data), A:L (low availability impact—potential for DoS through resource exhaustion, but not primary). The score reflects a dangerous but non-critical vulnerability: it's trivial to exploit and exposes sensitive data, but does not enable system takeover or widespread destruction.

Frequently asked questions