8.6
Élevée
CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
Description
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| typescript-sdk 1.24 | 1.24.0 → < 1.32.0 | 1.32.0 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de typescript-sdk
Les 8 CVE de typescript-sdk →
CVE-2026-111770
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
7.7
Élevée
CVE-2026-111768
Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
7.5
Élevée
CVE-2026-111769
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
Moyenne
CVE-2026-111771
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
Moyenne