Authorization bypass through user-controlled key in typescript-sdk - CVE-2026-111767
Published: November 9, 2026
Vulnerability identifier: #VU163210
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111767
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to access other clients' task information and disrupt their tasks.
The vulnerability exists due to missing session ownership checks in the experimental tasks feature of @modelcontextprotocol/sdk when an HTTP server shares one InMemoryTaskStore across sessions through the taskStore configuration. An unauthenticated remote attacker can list, read, and cancel tasks created by other clients sharing that store.
Affected software
typescript-sdk
How to mitigate CVE-2026-111767
Install security update from vendor's website.
typescript-sdk - update to 1.32.0