CVE-2026-111767

A flaw was found in the Model Context Protocol MCP TypeScript SDK @modelcontextprotocol/sdk. The experimental task storage feature taskStore does not verify which client session created a given task when multiple clients share a task store. A remote attacker sharing the same server instance can...