CVE-2026-55604

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global "SessionStore" accepts caller-supplied "sessionid" values without binding them to any authenticated principal or transport session. An attacker can enumerate active sessi...

CVE-2026-55605

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of "@arikusi/deepseek-mcp-server" exposes "POST /mcp" without any authentication: "createMcpExpressApp" is called without an "authProvider" and no middleware...

CVE-2026-55604: Authorization Bypass Through User-Controlled Key

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...