CVE-2026-25536highCWE-362CWE-367

CVE-2026-25536: fallo de gravedad alta en modelcontextprotocol typescript-sdk

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear typescript-sdk+ Monitorear @modelcontextprotocol/sdk

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.3%
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Productos afectados
modelcontextprotocol · typescript-sdk
CVEs relacionadas — modelcontextprotocol typescript-sdk

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-111768HIGHModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationEPSS 0.6%CVE-2025-66414HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-111771MEDIUMModel Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceEPSS 0.5%CVE-2026-111769MEDIUMModel Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodiesEPSS 0.4%CVE-2026-111770HIGHModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherEPSS 0.4%CVE-2026-111767HIGHMCP TypeScript SDK: Experimental tasks were not tied to the session that created themEPSS 0.3%