Skip to main content
MCP server retains context beyond its intended scope, allowing unauthorized access to stale session data.

​
How to resolve

Use ephemeral, per-session contexts by default: Make context windows short-lived and scoped to a single session. Enforce automatic deletion of context upon task completion. Restrict persistent memory to explicitly governed scenarios only, with documented justification and approval. Enforce context isolation and namespace segmentation: Establish unique context namespaces by user, agent, workflow, and tenant. Prevent direct inter-agent memory access. In multi-tenant setups, isolate retrieval indexes and vector stores to prevent cross-tenant data leakage. Define TTL policies with automatic purging: Set time-to-live policies for all stored context (e.g., session end, 30 minutes, or 24 hours maximum depending on sensitivity). Automatically purge expired contexts and embeddings. Scan and redact PII, secrets, and tokens before any context is persisted to storage. Log and audit all context access: Log agent ID, context ID, read/write events, and purge activities for all context storage operations. Integrate context access logs into SIEM systems. Require human approval before exporting, summarizing, or sharing sensitive context across session boundaries.

​
Risk

Governance/Compliance Insecure context persistence vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM02:2025 - Sensitive Information Disclosure): Enables unintended exposure of sensitive session data, credentials, and conversation history through context that persists beyond its intended scope.
  • OWASP Top 10 for LLM Applications (LLM06:2025 - Excessive Agency): Enables agents to access context beyond their authorized scope due to improper session isolation.
  • NIST AI RMF (GOVERN-1.5): Fails to implement adequate data governance controls for AI system context and memory management.
  • ISO/IEC 42001 (Data Management and Privacy Controls): Does not enforce proper data lifecycle management, allowing context to persist beyond its intended use and scope.
  • EU AI Act (Article 10): Violates data governance requirements by retaining user and session data beyond the scope necessary for the system’s intended purpose.
  • OWASP MCP Top 10 (MCP10:2025 - Context Injection & Over-Sharing): Enables unauthorized access to session data through insufficiently scoped context that persists across tasks, users, or agents.
Security Insecure context persistence allows attackers to access sensitive information from previous sessions, other users, or different agents by exploiting shared memory or storage mechanisms that lack proper isolation. When an MCP server stores context in global state or shared caches without session scoping, subsequent requests can retrieve stale credentials, private conversation history, or tool outputs belonging to other users. This enables session hijacking, cross-user data leakage, and privilege escalation. The risk is amplified in multi-tenant environments where multiple users or agents share the same MCP server instance.

​
Explanation

An MCP server stores, reuses, or retains session-, user-, agent-, or tool-specific context beyond its intended scope, allowing later requests, sessions, or agents to access stale or unauthorized context. This occurs when shared memory or storage mechanisms lack proper session isolation, enabling cross-session or cross-user data leakage.

​
Specifications

Trigger
  • MCP server scan detects shared memory or storage across sessions without proper session isolation, or absence of context scoping mechanisms that prevent cross-session data access
Severity
  • HIGH
Applies to: MCP Server