CVE-2026-55604

CVE-2026-55604 is a high-severity security vulnerability in @arikusi/deepseek-mcp-server (npm), affecting versions >= 1.4.2, < 1.7.0. It is fixed in 1.7.0.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

Cross-Session Data Exposure via Caller-Controlled session_id

Project / Repository: arikusi/deepseek-mcp-server
Affected version / commit tested: 1.6.0 / 04f28be2c6e99d3d4e443a6ae37cc35f0a71554a
Vulnerability type: Authorization bypass / cross-session data exposure
Authentication required: No

The process-global SessionStore accepts caller-supplied session_id values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via deepseek_sessions, then reuse a victim-controlled session_id in deepseek_chat to retrieve and continue the victim's conversation context.

Affected Code

  • src/session.ts:42 - caller-controlled session IDs are looked up directly from the global in-memory map.
  • src/session.ts:67 - a new session is stored under the caller-controlled ID without ownership binding.
  • src/session.ts:109 - getMessages() retrieves messages for any supplied session ID.
  • src/tools/deepseek-chat.ts:195 - deepseek_chat creates or reuses the supplied session_id.
  • src/tools/deepseek-chat.ts:197 - previous messages are loaded from the supplied session_id.
  • src/tools/deepseek-chat.ts:198 - previous messages are prepended into the attacker-controlled request.
  • src/tools/deepseek-chat.ts:243 - attacker-provided user messages are appended into the reused session.
  • src/tools/deepseek-chat.ts:245 - assistant responses are appended back into the reused session.
  • src/tools/deepseek-sessions.ts:37 - deepseek_sessions list enumerates all active sessions.
  • src/tools/deepseek-sessions.ts:53 - each enumerated session ID is rendered back to the caller.

PoC Overview

  1. Create a victim conversation with session_id = "victim-session".
  2. Call deepseek_sessions with action = "list" and observe that victim-session is disclosed.
  3. Call deepseek_chat again with session_id = "victim-session" from a separate attacker flow.
  4. The upstream request now includes the victim's prior messages before the attacker's message.

Validation Environment

Local runtime verification on Windows host with Node.js v24.11.1, using the repository code at the tested commit and a local mock DeepSeek client to capture the effective message list passed upstream.

Attached Evidence

01_deepseek-mcp-server_cross_session_data_exposure.txt

Patches (maintainer)

Fixed in 1.7.0. The HTTP transport's SessionStore is no longer a process-wide singleton: each MCP HTTP session gets its own store, injected into the deepseek_chat and deepseek_sessions tool handlers, so a session_id from one HTTP session cannot read, enumerate, or clear another session's state. STDIO transport was never affected (one process per client). Integration tests in src/transport-isolation.test.ts assert the isolation.

Affected versions >=1.4.2, <1.7.0 are deprecated on npm. Upgrade to 1.7.0 or later.

Workaround

If upgrading is not immediately possible, run in STDIO transport (unset TRANSPORT=http) or stop the HTTP server.

Credit

Reported independently by @232-323 and @2REBCat (tested against 1.6.0). The same root cause was found and fixed concurrently by the maintainer during a security audit, shipped in 1.7.0. All parties are credited as finders.

Note on severity

A connected client could read other clients' conversation history (C:H), inject messages into their sessions (I:L), and clear or delete other clients' sessions (A:L). Scope is unchanged: the impact stays within the application's own authorization boundary, which is a cross-tenant authorization bypass, so S:U is correct.

Impact

Any reachable caller can enumerate active session IDs and read prior conversation history stored in memory for other callers within the same server process. The same flaw also allows attacker-controlled continuation of another user's session state.

CVE-2026-55604 has a CVSS score of 8.6 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.7.0); upgrading removes the vulnerable code path.

Affected versions

@arikusi/deepseek-mcp-server (>= 1.4.2, < 1.7.0)

Security releases

@arikusi/deepseek-mcp-server → 1.7.0 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

  • Bind stored sessions to an authenticated transport session or other server-generated opaque identifier.
  • Do not allow arbitrary user-supplied session_id values to select existing server-side state.
  • Remove or restrict deepseek_sessions list so it does not disclose unrelated session IDs.
  • Reject reuse of a session unless the caller proves ownership of that session.

Frequently Asked Questions

  1. What is CVE-2026-55604? CVE-2026-55604 is a high-severity security vulnerability in @arikusi/deepseek-mcp-server (npm), affecting versions >= 1.4.2, < 1.7.0. It is fixed in 1.7.0.
  2. How severe is CVE-2026-55604? CVE-2026-55604 has a CVSS score of 8.6 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
  3. Which versions of @arikusi/deepseek-mcp-server are affected by CVE-2026-55604? @arikusi/deepseek-mcp-server (npm) versions >= 1.4.2, < 1.7.0 is affected.
  4. Is there a fix for CVE-2026-55604? Yes. CVE-2026-55604 is fixed in 1.7.0. Upgrade to this version or later.
  5. Is CVE-2026-55604 exploitable, and should I be worried? Whether CVE-2026-55604 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  6. What actually determines whether CVE-2026-55604 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  7. How do I fix CVE-2026-55604? Upgrade @arikusi/deepseek-mcp-server to 1.7.0 or later.

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo