High severity8.6NVD Advisory· Published Jul 9, 2026· Updated Jul 10, 2026
CVE-2026-55604
CVE-2026-55604
Description
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied session_id values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via deepseek_sessions, then reuse a victim-controlled session_id in deepseek_chat to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@arikusi/deepseek-mcp-servernpm | >= 1.4.2, < 1.7.0 | 1.7.0 |
Affected products
2- Range: 1.4.2 <= v < 1.7.0
- Range: 1.4.2 <= v < 1.7.0
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.