MCP TypeScript SDK accepted bearer tokens issued for another service
- Product
- MCP TypeScript SDK (@modelcontextprotocol packages)
- CVE
- CVE-2026-111771
- Affected
- @modelcontextprotocol/sdk 1.6.0 to 1.31.0; @modelcontextprotocol/server 2.0.0 to 2.2.0; @modelcontextprotocol/express 2.0.0 to 2.0.1; @modelcontextprotocol/server-legacy 2.0.0 to 2.3.0
- Fixed in
- @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, @modelcontextprotocol/server-legacy 2.3.1
Last verified against sources: October 26, 2026
Am I affected?
MCP TypeScript SDK (@modelcontextprotocol packages): affected @modelcontextprotocol/sdk 1.6.0 to 1.31.0; @modelcontextprotocol/server 2.0.0 to 2.2.0; @modelcontextprotocol/express 2.0.0 to 2.0.1; @modelcontextprotocol/server-legacy 2.0.0 to 2.3.0. Fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, @modelcontextprotocol/server-legacy 2.3.1.
- Check your version: run
npm ls @modelcontextprotocol/sdk. Versions >= 1.6.0, < 1.32.0 of @modelcontextprotocol/sdk are affected. [1] - Check your version: run
npm ls @modelcontextprotocol/server. Versions >= 2.0.0, < 2.3.0 of @modelcontextprotocol/server are affected. [1] - Check your version: run
npm ls @modelcontextprotocol/express. Versions >= 2.0.0, < 2.0.2 of @modelcontextprotocol/express are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install @modelcontextprotocol/sdk@1.32.0(first patched version 1.32.0). [1] - Upgrade to the fixed version: run
npm install @modelcontextprotocol/server@2.3.0(first patched version 2.3.0). [1] - Upgrade to the fixed version: run
npm install @modelcontextprotocol/express@2.0.2(first patched version 2.0.2). [1] - Upgrade to @modelcontextprotocol/sdk 1.32.0 or later, @modelcontextprotocol/server 2.3.0 or later (with @modelcontextprotocol/express 2.0.2 or later if you use it), or @modelcontextprotocol/server-legacy 2.3.1 or later. [1]
- Upgrading alone changes nothing: also pass expectedResource to requireBearerAuth() and return the token's audience from verifyAccessToken() as AuthInfo.resource. [1]
- If you cannot upgrade yet, reject any token whose aud does not include your server inside verifyAccessToken(). [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). [1]
- Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. [1]
- You are affected if your HTTP server uses requireBearerAuth() or verifyBearerToken(), its authorization server also issues tokens for other services, and your verifyAccessToken() does not check the token's audience (aud) itself. [1]
Impact
- A token meant for another service could be used against your MCP server. [1]
What was done
- Patched versions add an expectedResource setting that is off by default. [1]
- Upgrading alone changes nothing; the audience check has to be turned on. [1]
- Fixed versions are @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2 and @modelcontextprotocol/server-legacy 2.3.1. [1]
Sources
- GHSA-rvq5-wwqv-78pq — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-111771] MCP TypeScript SDK accepted bearer tokens issued for another service
Product: MCP TypeScript SDK (@modelcontextprotocol packages) | Affected: @modelcontextprotocol/sdk 1.6.0 to 1.31.0; @modelcontextprotocol/server 2.0.0 to 2.2.0; @modelcontextprotocol/express 2.0.0 to 2.0.1; @modelcontextprotocol/server-legacy 2.0.0 to 2.3.0 | Fixed in: @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, @modelcontextprotocol/server-legacy 2.3.1
Summary: The SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience).
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-111771-mcp-typescript-sdk-modelcontextprotocol-packagesCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-111771
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.