CVE-2026-111767

8.6 HIGHpublic exploit available

Published 2026-10-20 · Updated 2026-10-20

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses

CWE-639, CWE-862

Public exploit & PoC references

https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa
https://github.com/modelcontextprotocol/typescript-sdk/pull/2925
https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw

All references

https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa
https://github.com/modelcontextprotocol/typescript-sdk/pull/2925
https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-102298
MEDIUMCVE-2026-104960PoC
HIGHCVE-2026-104971PoC
MEDIUMCVE-2026-105698PoC
CRITICALCVE-2026-105859PoC
MEDIUMCVE-2026-107850PoC
MEDIUMCVE-2026-109427PoC
HIGHCVE-2026-109431

Related by shared AI tags and CWE weakness class. Browse the full archive.