{"id":"CVE-2026-111767","kind":"vulnerability","aliases":["CVE-2026-111767","GHSA-22jm-h49p-29qw"],"related":[],"title":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","description":"### Summary\nIn affected versions, the experimental tasks feature (`taskStore`) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks.\n\nExperimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them.\n\n### Am I affected?\nOnly if your HTTP server passes `taskStore` to `McpServer` or `Server`. If `grep -ri taskstore --exclude-dir=node_modules .` finds nothing, you are not affected.\n\nAffected versions: `@modelcontextprotocol/sdk` 1.24.0 through 1.31.0. The 2.x packages are not affected.\n\n### Fix\nUpgrade to `@modelcontextprotocol/sdk` 1.32.0 or later. Each task is now tied to the session that created it, so a client that starts a new session can no longer reach its earlier tasks.\n\nIf you cannot upgrade yet, remove `taskStore`, or create one `InMemoryTaskStore` per session.","summary":"The MCP TypeScript SDK's experimental tasks feature did not check which session created a task, so clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. The flaw is in the MCP server code path, so it is ai-tooling.","severity":"high","cvss":8.600000381469727,"epss":0.003449999960139394,"exploited":false,"exploited_at":null,"products":[{"name":"@modelcontextprotocol/sdk","fixed":["1.32.0"],"affected":">= 1.24.0, < 1.32.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","cwe-639","cwe-862","mcp","npm","self-hosted","typescript"],"not_affected_if":["no-taskstore-usage","sdk-2.x","sdk-below-1.24.0"],"how_to_check":"grep -ri taskstore --exclude-dir=node_modules . (no hits means not affected)\nCheck package.json or lockfile for @modelcontextprotocol/sdk between 1.24.0 and 1.31.0\nConfirm whether McpServer or Server is constructed with a taskStore option","fix":"Upgrade @modelcontextprotocol/sdk to 1.32.0 or later.\nIf you cannot upgrade, remove taskStore or create one InMemoryTaskStore per session; the upstream advisory recommends stopping use of experimental tasks.","status":"open","published_at":"2026-10-20T18:26:54+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:56:18+00:00","updated_at":"2026-10-23T20:56:18+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T20:56:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @modelcontextprotocol/sdk to 1.32.0 or later.\nIf you cannot upgrade, remove taskStore or create one InMemoryTaskStore per session; the upstream advisory recommends stopping use of experimental tasks.","reach":"network","impact":"medium","summary":"The MCP TypeScript SDK's experimental tasks feature did not check which session created a task, so clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. The flaw is in the MCP server code path, so it is ai-tooling.","category":"ai-tooling","who_cares":["mcp","typescript","npm","self-hosted"],"confidence":0.85,"needs_auth":"unknown","worst_case":"A remote client reads, lists or cancels other clients' MCP tasks","analyst_note":"","how_to_check":"grep -ri taskstore --exclude-dir=node_modules . (no hits means not affected)\nCheck package.json or lockfile for @modelcontextprotocol/sdk between 1.24.0 and 1.31.0\nConfirm whether McpServer or Server is constructed with a taskStore option","needs_analyst":false,"not_affected_if":["no-taskstore-usage","sdk-2.x","sdk-below-1.24.0"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000557,"input_tokens":3150,"output_tokens":484,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-07':120C '-111767':16A,24A '-2026':15A,23A '-28':121C '-639':30B '-862':32B '1.24.0':171C '1.31.0':173C '1.32.0':185C '2':175C '2026':119C '22jm':19A '29qw':21A 'action':133C 'affect':86C,141C,167C,168C,180C 'ai':27B,82B 'ai-tool':26B,81B 'best':130C 'cancel':64B,109C 'cannot':216C 'check':49B,95C 'client':56B,101C,201C 'code':76B 'could':60B,105C 'cours':131C 'creat':13A,52B,98C,197C,222C 'cve':14A,22A 'cwe':29B,31B 'deprec':117C 'dir':159C 'earlier':212C 'exclud':158C 'exclude-dir':157C 'experiment':4A,44B,89C,114C 'extens':128C 'featur':46B,91C 'find':162C 'fix':181C 'flaw':70B 'ghsa':18A 'ghsa-22jm-h49p-29qw':17A 'grep':154C 'h49p':20A 'host':37B 'http':145C 'inmemorytaskstor':59B,104C,224C 'later':187C 'list':61B,106C 'longer':209C 'mcp':1A,33B,40B,74B 'mcpserver':150C 'modelcontextprotocol/sdk':25A,170C,184C 'modul':161C 'new':205C 'node':160C 'noth':163C 'npm':34B 'one':58B,103C,223C 'packag':177C 'pass':147C 'path':77B 'per':225C 'reach':210C 'read':62B,107C 'redesign':127C 'remov':219C 'replac':123C 'ri':155C 'sdk':3A,42B 'self':36B 'self-host':35B 'server':75B,146C,152C 'session':11A,51B,97C,195C,206C,226C 'share':57B,102C 'specif':122C 'start':203C 'stop':136C 'summari':84C 'task':5A,45B,54B,68B,90C,100C,113C,115C,189C,213C 'taskstor':92C,148C,156C,220C 'tie':8A,192C 'tool':28B,83B 'typescript':2A,38B,41B 'upgrad':182C,217C 'use':137C 'version':87C,169C 'x':176C 'yet':218C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T18:26:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-22jm-h49p-29qw","url":"https://github.com/advisories/GHSA-22jm-h49p-29qw","severity":"high","published_at":"2026-10-20T18:26:54+00:00","modified_at":"2026-10-20T18:26:55+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","severity":null,"published_at":"2026-10-20T19:17:30+00:00","modified_at":"2026-10-20T19:53:10+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}