MCP TypeScript SDK CVE-2026-111770

Exploitation requires ALL of: (1) an MCP server exposed over HTTP (Streamable HTTP transport), (2) more than one client able to reach the same endpoint, and (3) application code that creates the transport or the McpServer/Server instance ONCE at startup and shares it across requests - specifically a stateless transport (sessionIdGenerator: undefined) reused across requests, or a single server object reused across requests/sessions, exactly as the pre-fix README examples for @modelcontextprotocol/hono, express, fastify and node demonstrated. Limiting factors that remove exposure: stdio servers are not affected; createMcpHandler() used with a factory that builds a new server per call is not affected; @modelcontextprotocol/sdk 1.26.0+ is not affected; and per-request or per-session (sessionIdGenerator set) construction is safe. No end-user interaction or authentication is needed, but the vulnerable shared-instance deployment pattern is the hard prerequisite.

This is a genuine information-disclosure flaw in the MCP TypeScript server SDK (@modelcontextprotocol/server 2.0.0-2.2.0), scored CVSS 7.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H. The CVSS signals are mixed: AV:N and PR:N indicate a remote, unauthenticated reach, but AC:H correctly reflects that triggering requires a timing-dependent JSON-RPC id collision between concurrent clients AND a specific vulnerable deployment pattern (a transport or server instance created once at startup and shared across clients). No EPSS score, CISA KEV listing, or POC is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' - this is not evidence of absence, only that none was provided. The real-world risk is moderate and conditional rather than a mass-exploitable critical: the leak can occur accidentally in normal operation (ids collide because SDK clients number requests from 0), which raises the data-exposure likelihood for affected deployments, but exploitation is not attacker-steerable in a reliable targeted sense and depends on the victim's code shape. Because exposure hinges on the operator having followed the (now-corrected) README shared-instance pattern, treat this as a high-priority patch for multi-tenant HTTP MCP servers but lower urgency for stdio or per-request/per-session deployments.

Two or more clients connect over HTTP to an MCP server that shares a single stateless transport or a single McpServer/Server instance created at startup. Because the SDK matches messages to a connection by JSON-RPC id alone and all clients number their requests from 0, the server routes one client's responses and notifications to another client, disclosing that client's data. No public exploit code was identified at time of analysis; the condition can arise unintentionally in ordinary concurrent use.