CVE-2026-111767

LOWCVSS 8.6 · HIGH

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

Alvif Sandana Mahardika@siDandott20h
One shared task store — and client A could read, list, and cancel client B's tasks. CVE-2026-111767 (CVSS 8.6) hit the MCP TypeScript SDK: its experimental taskStore never checked which session created a task. Fixed in 1.32.0. Does your agent infra enforce session isolation?
0001045
41 followersView on X

Explore more

Back to dashboard