Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-111767

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

modelcontextprotocol typescript-sdk

  • >= 1.24.0, < 1.32.0affected

References