{"id":"EUVD-2026-42720","enisaUuid":"92f1c70a-4e3b-37f0-8d17-c85c0d14ae29","description":"DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context. Version 1.7.0 contains a patch.","datePublished":"Jul 9, 2026, 9:13:15 PM","dateUpdated":"Jul 10, 2026, 2:42:09 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578\nhttps://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0\n","aliases":"CVE-2026-55604\nGHSA-fh3r-g96v-f578\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"0ee8ff33-2450-3293-b2fa-0b88cefe6dd8","product":{"name":"deepseek-mcp-server","vendor":{"name":"arikusi"}},"product_version":"1.4.2, \u003c 1.7.0"}],"enisaIdVendor":[{"id":"421adaaa-93c5-3e17-936d-22d458b90b07","vendor":{"name":"arikusi"}}],"enisaIdVulnerability":[{"id":"5e96cf89-425f-38d5-baac-32e7ff1682ab","vulnerability":{"id":"CVE-2026-55604","description":"DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context. Version 1.7.0 contains a patch.","datePublished":"Jul 9, 2026, 9:13:15 PM","dateUpdated":"Jul 10, 2026, 2:42:09 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578\nhttps://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0\n","enisa_id":"EUVD-2026-42720\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Nov 1, 2026, 7:17:06 AM","vulnerabilityProduct":[{"id":"72276114-bd70-3e8c-8be5-8f63686650f9","product":{"name":"deepseek-mcp-server","vendor":{"name":"arikusi"}},"product_version":"1.4.2, \u003c 1.7.0"}],"vulnerabilityVendor":[{"id":"9ec1fd16-4579-35cc-a57d-a04421645ab1","vendor":{"name":"arikusi"}}]}},{"id":"bd301a4e-c6d6-3198-b315-b4bc530f87a3","vulnerability":{"id":"GHSA-fh3r-g96v-f578","description":"@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key","datePublished":"Aug 25, 2026, 6:37:27 PM","dateUpdated":"Aug 25, 2026, 6:37:27 PM","baseScore":0.0,"references":"https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55604\nhttps://github.com/arikusi/deepseek-mcp-server\nhttps://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0\n","enisa_id":"EUVD-2026-42720\n","aliases":"CVE-2026-55604\nGHSA-fh3r-g96v-f578\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}