The maintainers of the official TypeScript software development kit for the Model Context Protocol have disclosed five vulnerabilities, including one in which a server shared by several clients could deliver one client’s messages to another. GitHub’s advisory database published the five advisories, CVE-2026-111767 through CVE-2026-111771, on October 20.
The Model Context Protocol, or MCP, is the interface many AI applications and agents use to connect models to external tools and data. The SDK’s packages are distributed through npm under the @modelcontextprotocol name.
The cross-client flaw, CVE-2026-111770, is rated high severity with a CVSS score of 7.7. It affects @modelcontextprotocol/server versions before 2.3.0 when an application creates one server or transport at startup and more than one client can reach it. Because the SDK matched messages by request ID alone, a message meant for one client could reach another. Version 2.3.0 rejects a second connection to the same server instance, and the advisory says affected applications need a code change, such as creating a new server and transport for each request or session.
A second flaw, CVE-2026-111771, rated 6.8, let servers using the SDK’s bearer-token authentication accept a valid token that the same authorization server had issued for a different service. “Upgrading alone changes nothing,” the advisory says. Fixed versions add an option for the server to name its expected audience, and the application must also return each token’s audience from its verification code.
CVE-2026-111768, rated high at 7.5, allowed a single request within the default 4 MiB body limit to exhaust a server’s memory, most severely for tools that accept array or record inputs. The fix depends on a new limit on tool input elements, which is off by default, along with a lower request body limit.
On the client side, CVE-2026-111769, rated 6.5, caused client transports and OAuth functions to send custom headers and session IDs to a different origin when redirected, and on some redirects to resend request bodies that could contain OAuth refresh tokens and client secrets. Fixed versions follow only same-origin redirects by default, and the advisory tells users whose requests may have reached hosts they do not control to rotate keys and revoke tokens. CVE-2026-111767, rated high at 8.6, let clients sharing an in-memory store for the SDK’s experimental tasks feature list, read and cancel each other’s tasks.
The fixes ship in @modelcontextprotocol/sdk 1.32.0 and in version 2.3.0 of the server and client packages. A sixth advisory, which has no CVE, set default limits of 4 MiB on request bodies and 100 messages per batch on HTTP servers.
The advisories first appeared in the SDK’s GitHub repository on October 2, 5 and 15 before reaching the advisory database, and each credits named reporters. A February advisory, CVE-2026-25536, covered the same class of cross-client mix-up in version 1 of the SDK, which was fixed in 1.26.0. In September, maintainers disclosed CVE-2026-104850, in which a malicious MCP server could direct a client’s stored refresh tokens and client secrets to an authorization server of its choosing.
Sources: MCP TypeScript SDK, GitHub Advisory Database
–
By the Control Plane Editorial Team