Skip to main content

Authorization Bypass Through User-Controlled Key in @modelcontextprotocol/sdk

CVE-2026-111767

  • @modelcontextprotocol/sdk
High
8.6/10

Summary

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 prior to 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • LOW

CWE-639 - Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

Advisory Timeline

  • Published