CVE-2026-111767: falha de alta gravidade em modelcontextprotocol typescript-sdk
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.3%
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
modelcontextprotocol · typescript-sdkCVEs relacionadas — modelcontextprotocol typescript-sdk
No mesmo produto, das mais perigosas para as menos.
CVE-2025-66414HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-25536HIGH@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseEPSS 0.3%CVE-2026-104850HIGHMCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverEPSS 0.2%CVE-2026-111770HIGHModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherEPSS —CVE-2026-111768HIGHModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationEPSS —CVE-2026-111769MEDIUMModel Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodiesEPSS —