Threat · curated 12 Sep 2026

The Architectural Failure Behind the MCP Session Isolation Crisis

First reported today forkast.news

Coverage timeline

Single-source analysis — first reported, latest, and curated coincide.

Why it matters

MCP session isolation failures expose a systemic architectural weakness where the transport layer fails to bind cached credentials to authenticated principals, enabling credential leakage and cross-tenant compromise across widely used agent infrastructure.

CVE-2026-16498, a CVSS 10.0 flaw in the Terraform MCP Server, allowed cross-tenant credential reuse in streamable-HTTP stateless transport because the credential cache relied on non-unique session identifiers, letting one user's Terraform token be reused by others. Similar flaws affected the Consul MCP Server (CVE-2026-16326, CVSS 10.0), a stateful Terraform variant (CVE-2026-16496), and the MCP Python SDK (CVE-2026-52869), which permitted JSON-RPC message injection into other clients' sessions; fixes and a July 28, 2026 MCP spec update abandoning the Mcp-Session-Id header address the pattern.