MCP SDK CVE-2026-111767 Leaks Shared Session Data; Patch 1.32.0 Fixes Isolation Failure for Users

The Model Context Protocol (MCP) TypeScript SDK contains a high-severity vulnerability that compromises session isolation within its experimental tasks feature. According to the GitHub advisory GHSA-22jm-h49p-29qw, the flaw impacts npm package @modelcontextprotocol/sdk versions 1.24.0 through 1.31.0. A fix is available in version 1.32.0. Managed service providers must verify if their clients use this specific package and upgrade accordingly to prevent unauthorized task access.

How it unfolded

• The experimental tasks feature in the MCP SDK failed to validate which session created a specific task.
• This lack of validation allowed clients sharing a single InMemoryTaskStore instance to list, read, and cancel tasks belonging to other sessions.
• The National Vulnerability Database assigned CVE-2026-111767 with a CVSS score of 8.6, classifying the weakness as high severity.
• The vendor released version 1.32.0, which ties each task to its creating session, blocking cross-session access.

Who is affected

Only systems that pass the `taskStore` parameter to `McpServer` or `Server` are affected by this vulnerability. According to the advisory, if a codebase does not reference `taskstore`, it is not impacted. The 2.x series of the packages is not affected. The issue stems from the `InMemoryTaskStore` component, which did not enforce session boundaries. This allows any client connected to the same store to view or modify tasks initiated by other users, leading to potential privacy leaks and data integrity issues.

Our take on the response

The vendor’s response includes both a patch and a structural recommendation. Version 1.32.0 resolves the immediate technical flaw by enforcing session-specific task ownership. However, the advisory notes that the experimental tasks feature is deprecated. The 2026-07-28 specification replaced these tasks with a redesigned extension. That suggests organizations should plan to migrate away from the deprecated feature entirely, rather than relying solely on the patch for long-term security.

Who needs to act first

Teams usually prioritize systems with high user concurrency or shared infrastructure first. Check whether any production environments utilize the affected SDK versions with shared task stores. If so, isolate those environments immediately. Test the upgrade in a staging environment to ensure compatibility with existing server configurations. Back up current configurations before applying changes. If an immediate upgrade is not possible, consider removing the task store functionality or implementing separate stores for each session to reduce exposure until a full update is rolled out.

What to do and how to stay safe: Model Context Protocol

• Scan your codebase for references to `taskstore` to identify affected projects.
• Upgrade @modelcontextprotocol/sdk to version 1.32.0 or later in all affected environments.
• Review server configurations to ensure `taskStore` is not passed to `McpServer` if upgrading is delayed.
• Plan migration away from the deprecated experimental tasks feature to the new specification.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the MCP SDK are vulnerable?

Versions 1.24.0 through 1.31.0 of @modelcontextprotocol/sdk are affected by CVE-2026-111767.

Is there a fix available for this vulnerability?

Yes, upgrading to version 1.32.0 or later resolves the session isolation flaw.

How can I check if my system is affected?

Search your codebase for `taskstore`; if it is passed to `McpServer` or `Server`, you are affected.