CVE-2026-111767
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
| CWE | CWE-639 CWE-862 |
| Vendor | modelcontextprotocol |
| Product | typescript-sdk |
| Published | Oct 20, 2026 |
| Last Updated | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for modelcontextprotocol typescript-sdk
Be the first to know when new high vulnerabilities affecting modelcontextprotocol typescript-sdk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected Versions
modelcontextprotocol / typescript-sdk
>= 1.24.0, < 1.32.0