CVEvulnerability

CVE-2026-111767

8.6 HIGH Published 2026-10-20 Modified 2026-10-20 Official page ↗

Status: Deferred
Published: 2026-10-20
Last modified: 2026-10-20
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses: CWE-639, CWE-862

Description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

Weakness · CWE (2)

CWE-639 Authorization Bypass Through User-Controlled Key weakness
CWE-862 Missing Authorization weakness

References

https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa github.com
https://github.com/modelcontextprotocol/typescript-sdk/pull/2925 github.com
https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw github.com

CVE-2026-111767

Description

Related

Weakness · CWE (2)

References