13 matches found
CVE-2026-111767
A flaw was found in the Model Context Protocol MCP TypeScript SDK @modelcontextprotocol/sdk. The experimental task storage feature taskStore does not verify which client session created a given task when multiple clients share a task store. A remote attacker sharing the same server instance can...
Linux Distros Unpatched Vulnerability : CVE-2026-111767
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental...
CVE-2026-111767
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767
The MCP TypeScript SDK (@modelcontextprotocol/sdk) versions 1.24.0 through 1.31.0 are vulnerable due to a flaw in the experimental taskStore feature. The root cause is that tasks were not tied to specific sessions, allowing clients sharing a single InMemoryTaskStore to unauthorizedly list, read, ...
GHSA-22JM-H49P-29QW MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...
PT-2026-120290
Summary In affected versions, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned...
PT-2026-118611
Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.24.0 through 1.31.0 Description The experimental tasks feature taskStore fails to verify which session created a specific task. Consequently, clients sharing a single InMemoryTaskStore can list, read, and...
Model Context Protocol MCP TypeScript SDK Authorization Vulnerability
The Model Context Protocol MCP TypeScript SDK versions from 1.24.0 to 1.32.0 have a security vulnerability. This vulnerability arises from the experimental task feature taskStore not checking the sessions used to create tasks. Clients sharing the same InMemoryTaskStore can potentially list, read,...
WS-2026-0090
In @modelcontextprotocol/sdk 1.24.0 through 1.31.0, the experimental tasks feature taskStore did not check which session created a task: InMemoryTaskStore ignored the sessionId, so clients sharing one InMemoryTaskStore on an HTTP server could list, read and cancel each other's tasks and receive...