High severity8.6NVD Advisory· Published Oct 20, 2026· Updated Oct 20, 2026

CVE-2026-111767

Description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

Affected products

Modelcontextprotocol/Typescript SDKllm-fuzzy
Range: 1.24.0 <= v < 1.32.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-22jm-h49p-29qwghsaADVISORY
github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fanvd
github.com/modelcontextprotocol/typescript-sdk/pull/2925nvd
github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qwnvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000