CVE-2026-55604

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.

• CWE-639

• https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0
• https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578
• https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578

Published

Jul 9, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55596Plate is a rich-text editor with AI and shadcn/ui. From 53.0…8.7
• CVE-2026-55597ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55599phpseclib is a PHP secure communications library. From 0.1.1…5.8
• CVE-2026-5560A vulnerability was found in PHPGurukul Online Shopping Port…6.3
• CVE-2026-55602http-proxy-middleware is node.js http-proxy middleware. From…8.6
• CVE-2026-55603http-proxy-middleware is node.js http-proxy middleware. From…7.5
• CVE-2026-55605DeepSeek MCP Server is an MCP server for DeepSeek V4. Starti…5.3
• CVE-2026-55607Claude Code is an agentic coding tool. From 2.1.38 until 2.…8.8
• CVE-2026-55608n8n-MCP is an MCP server that provides AI assistants access …5.4
• CVE-2026-5561A vulnerability was determined in Campcodes Complete POS Man…6.3
• CVE-2026-55611AnythingLLM is an application that turns pieces of content i…0
• CVE-2026-55615Langroid is a framework for building large-language-model-po…9.2