CVE-2026-111767: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other’s tasks.
Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.
References
- github.com/advisories/GHSA-22jm-h49p-29qw
- github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa
- github.com/modelcontextprotocol/typescript-sdk/pull/2925
- github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw
- nvd.nist.gov/vuln/detail/CVE-2026-111767
Code Behaviors & Features
Detect and mitigate CVE-2026-111767 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →