Patch Forecast
Amber warning
Patch this week.

CVE-2026-111767 · GHSA-22jm-h49p-29qw

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

Risk score
67/100
CVSS
8.6 v3.1
Exploit chance (30 days)
0.3%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The MCP TypeScript SDK's experimental tasks feature did not check which session created a task, allowing clients to list, read, and cancel each other's tasks. An attacker could exploit this vulnerability to gain control over other clients' tasks.
Affected
{'products': ['MCP TypeScript SDK'], 'packages': [{'ecosystem': 'npm', 'name': '@modelcontextprotocol/sdk', 'vulnerable': '>= 1.24.0, < 1.32.0', 'patched': '1.32.0'}], 'versions': ['1.24.0 to 1.32.0 (exclusive)', '1.32.0']}
Fix
Upgrade to version 1.32.0 or later
Exploitation
No known exploitation

Story map

Story map: @modelcontextprotocol/sdkTHE FLAWSTHE FIXCVE-2026-111767MCP TypeScript SDK:Experimental tasks were nottied to the session that…CVSS 8.6 · EPSS 0%CVE-2026-104850MCP TypeScript SDK: OAuthclient could send credentials toan authorization server…CVSS 7.5 · EPSS 0%CVE-2026-111768MCP TypeScript SDK: One HTTPrequest within the default sizelimit could exhaust server…CVSS 7.5CVE-2026-111771MCP TypeScript SDK: Serverbearer authentication acceptedtokens issued for another…CVSS 6.8Upgrade…1.32.0 · 1.31.0 · 2.2.0or later on your release lineWho is exposed{'products': ['MCP TypeScriptSDK'], 'packages':[{'ecosystem': 'npm', 'name':'@modelcontextprotocol/sdk','vulnerable': '>= 1.24.0, <…AMBER · PATCH THIS WEEK@modelcontextprotocol/sdkThe MCP TypeScript SDK'sexperimental tasks feature didnot check which session createda task, allowing clients to list,read, and cancel each other'stasks. An attacker could exploitthis vulnerability to gain…Where it standsNo known exploitationCONNECTS TOSame weaknessAuthorisation bypass (CWE-639)246 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@modelcontextprotocol/sdk: Amber, patch this week. The MCP TypeScript SDK's experimental tasks feature did not check which session created a task, allowing clients to list, read, and cancel each other's tasks. An attacker could exploit this vulnerability to gain control over other clients' tasks.

The flaws

  • CVE-2026-111767: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (CVSS 8.6 · EPSS 0%)
  • CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (CVSS 7.5 · EPSS 0%)
  • CVE-2026-111768: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (CVSS 7.5)
  • CVE-2026-111771: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service (CVSS 6.8)

The fix

Upgrade @modelcontextprotocol/sdk: 1.32.0 · 1.31.0 · 2.2.0 or later on your release line

Who is exposed: {'products': ['MCP TypeScript SDK'], 'packages': [{'ecosystem': 'npm', 'name': '@modelcontextprotocol/sdk', 'vulnerable': '>= 1.24.0, < 1.32.0', 'patched': '1.32.0'}], 'versions': ['1.24.0 to 1.32.0 (exclusive)', '1.32.0']}

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.6 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@modelcontextprotocol/sdknpm>= 1.24.0, < 1.32.01.32.0

References

Original description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.