Security hardening for sessions, docs paths, and schema validation

Published: July 15, 2026

v2.26.3

Fixes

  • Sessions: MCP sessions are now bound to the authenticating user, so a caller can no longer reuse or terminate another user's session by supplying its id.
  • read_docs tool: The resolved docs path is now validated so percent-encoded traversal (e.g. %2e%2e) can no longer escape the /docs/ scope on the docs host.
  • General internal schema validation improvements.
Loading...
Security hardening for sessions, docs paths, and schema validation | Sanity Docs