CVE-2026-111767 Details
Description
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
A vulnerability exists in the Model Context Protocol TypeScript SDK, specifically in versions 1.24.0 prior to 1.32.0. The issue arises within the experimental tasks feature, where tasks created in a shared InMemoryTaskStore were not tied to the session that created them. This flaw allowed clients to list, read, and cancel each other's tasks. The vulnerability has been addressed in version 1.32.0.
Upgrade to version 1.32.0 or later, where tasks are now tied to the session that created them. If an upgrade is not possible, remove the 'taskStore' option or create a separate 'InMemoryTaskStore' for each session.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa | [email protected] | Source CodeVendor |
| https://github.com/modelcontextprotocol/typescript-sdk/pull/2925 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Model Context Protocol MCP TypeScript SDK | >= 1.24.0, < 1.32.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | New CVE Received | [email protected] |
| Oct 20, 2026 | CVE Modified | CISA-ADP |