MCP TypeScript SDK EUVD-2026-105256

Exploitable only when an HTTP-based MCP server explicitly passes a single shared InMemoryTaskStore (or a custom TaskStore that ignores sessionId) to McpServer or Server and serves multiple client sessions from that one store, using the experimental, deprecated tasks feature. Limiting factors: the feature is not enabled by default (operators can confirm non-exposure via 'grep -ri taskstore'); it is deprecated and removed in the 2026-07-28 spec; stdio servers, stateless/no-session HTTP servers, and deployments using one InMemoryTaskStore per session are not vulnerable to cross-session leakage; 2.x packages are unaffected. Exposure is confined to versions 1.24.0 through 1.31.0.

This is a CWE-639 authorization-bypass (IDOR-style cross-session access) flaw with a vendor/NVD CVSS of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), implying a remote, low-complexity, unauthenticated issue with high confidentiality and low integrity/availability impact. However, several signals pull the real-world priority well below what the 8.6 base score suggests. No EPSS probability, no CISA KEV listing, and no public exploit code are present in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' Most importantly, the affected code path is the experimental, now-deprecated tasks feature (taskStore), which is OFF by default: a server is only exposed if it explicitly passes a single shared InMemoryTaskStore to McpServer/Server across multiple sessions. The GHSA advisory itself notes the feature is deprecated and replaced in the 2026-07-28 spec, and that a simple grep for 'taskstore' tells operators whether they are affected at all. The PR:N in the vector is defensible because any connecting MCP client can abuse an unscoped store, but AV:N/AC:L understate the deployment precondition (a specific non-default, experimental configuration). Net assessment: a genuine access-control bug that should be patched, but in practice this is a high-CVSS / low-real-world-exposure issue driven by a niche opt-in feature rather than a broadly exploitable, actively-targeted vulnerability.

An MCP HTTP server is configured with a single shared InMemoryTaskStore passed to McpServer/Server and serves multiple client sessions. A malicious or unauthorized client connects in its own session and calls tasks/list, tasks/get and tasks/result to read tasks (and their results) created by other clients, and tasks/cancel to abort them. No public proof-of-concept exists; exploitation leverages the documented low-complexity, network-reachable API surface with no authentication qualifier beyond being a connected client.