CVE-2026-25536highCWE-362CWE-367

CVE-2026-25536: falha de alta gravidade em modelcontextprotocol typescript-sdk

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar typescript-sdk+ Monitorar @modelcontextprotocol/sdk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
modelcontextprotocol · typescript-sdk
CVEs relacionadas — modelcontextprotocol typescript-sdk

No mesmo produto, das mais perigosas para as menos.

CVE-2026-111768HIGHModel Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationEPSS 0.6%CVE-2025-66414HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-111771MEDIUMModel Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceEPSS 0.5%CVE-2026-111769MEDIUMModel Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodiesEPSS 0.4%CVE-2026-111770HIGHModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherEPSS 0.4%CVE-2026-111767HIGHMCP TypeScript SDK: Experimental tasks were not tied to the session that created themEPSS 0.3%