CVE-2026-111767

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

State: Published
Severity: 8.6 High
Published: Oct 20, 2026
Updated: Oct 20, 2026
Reserved: Oct 16, 2026

Description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization

Affected Products

Product	Versions
typescript-sdkmodelcontextprotocol	>= 1.24.0, < 1.32.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.