CVE-2026-111767: MCP TypeScript SDK experimental tasks were not tied to the session that created them
- Product
- @modelcontextprotocol/sdk (npm)
- CVE
- CVE-2026-111767
- Affected
- >= 1.24.0, < 1.32.0
- Fixed in
- 1.32.0
Last verified against sources: October 16, 2026
Am I affected?
@modelcontextprotocol/sdk (npm): affected >= 1.24.0, < 1.32.0. Fixed in 1.32.0.
What to do now
- Upgrade to @modelcontextprotocol/sdk 1.32.0 or later, remove taskStore, or create one InMemoryTaskStore per session. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- According to GitHub Advisory Database's advisory (Oct 20, 2026), the experimental tasks feature (taskStore) did not check which session created a task. [1]
Impact
- Clients sharing one InMemoryTaskStore over HTTP could list, read and cancel each other's tasks (CVSS 8.6). [1]
What was done
- Patched in @modelcontextprotocol/sdk 1.32.0 so each task is tied to the session that created it. [1]
Sources
- GHSA-22jm-h49p-29qw — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-111767] CVE-2026-111767: MCP TypeScript SDK experimental tasks were not tied to the session that created them
Product: @modelcontextprotocol/sdk (npm) | Affected: >= 1.24.0, < 1.32.0 | Fixed in: 1.32.0
Summary: According to GitHub Advisory Database's advisory (Oct 20, 2026), the experimental tasks feature (taskStore) did not check which session created a task.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-111767-mcp-typescript-sdk-taskstore-sessionCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-111767
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.