CVE-2026-111767: fallo de gravedad alta en modelcontextprotocol typescript-sdk
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.3%
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Productos afectados
modelcontextprotocol · typescript-sdkCVEs relacionadas — modelcontextprotocol typescript-sdk
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-111768HIGHModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationEPSS 0.6%CVE-2025-66414HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-111771MEDIUMModel Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceEPSS 0.5%CVE-2026-111769MEDIUMModel Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodiesEPSS 0.4%CVE-2026-111770HIGHModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherEPSS 0.4%CVE-2026-25536HIGH@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseEPSS 0.3%