CVE-2026-111767High· 8.6▾ TwilightMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Client…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.
typescript-sdk >= 1.24.0, < 1.32.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@modelcontextprotocol/sdk >= 1.24.0, < 1.32.0Patched in:
@modelcontextprotocol/sdk 1.32.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104850High· 7.5MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
CVE-2026-102298High· 7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check
CVE-2026-111771Medium· 6.8MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111770High· 7.7MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
CVE-2026-111768High· 7.5MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111769Medium· 6.5MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies