{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/sdk-vulnerability/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-111770"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@modelcontextprotocol/server (\u003e= 2.0.0, \u003c 2.3.0)"],"_cs_severities":["high"],"_cs_tags":["information-disclosure","mcp","sdk-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Model Context Protocol"],"content_html":"\u003cp\u003eThe MCP TypeScript SDK is vulnerable to cross-client message leakage when implemented as a shared, stateless instance. Because the protocol identifies messages by JSON-RPC IDs, which typically reset at 0 for every client, concurrent requests reaching a shared \u003ccode\u003eMcpServer\u003c/code\u003e or transport instance result in ID collisions. In this state, an MCP server may erroneously return one client's responses or push notifications to another client sharing the same instance. This behavior was unintentionally encouraged by early SDK documentation, which provided examples using globally initialized server instances in common Node.js frameworks like Hono, Express, and Fastify. The vulnerability affects \u003ccode\u003e@modelcontextprotocol/server\u003c/code\u003e versions 2.0.0 through 2.2.0. Successful exploitation allows for sensitive information disclosure between authorized clients interacting with the same MCP server instance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized data access where clients receive responses or notifications intended for other users. This impacts any multi-user environment where a single MCP server is exposed via HTTP and initialized as a singleton. Organizations relying on this SDK for integrating LLM tools or internal automation are at risk of cross-session data leakage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003e@modelcontextprotocol/server\u003c/code\u003e package to version 2.3.0 or later to ensure the SDK actively enforces connection isolation and rejects attempts to share instances.\u003c/li\u003e\n\u003cli\u003eAudit all existing MCP server implementations for the singleton pattern; refactor code to instantiate \u003ccode\u003eMcpServer\u003c/code\u003e and transport objects either per-request or per-session using a \u003ccode\u003esessionIdGenerator\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eValidate implementation patterns against the official SDK update guidance to ensure session-specific state management is strictly applied.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T23:55:37Z","date_published":"2026-10-20T23:55:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mcp-sdk-message-leak/","summary":"A high-severity vulnerability in the MCP TypeScript SDK (CVE-2026-111770) allows an MCP server to misroute messages between clients due to JSON-RPC request ID collisions when server instances are incorrectly shared.","title":"Model Context Protocol TypeScript SDK: Cross-client message leakage (CVE-2026-111770)","url":"https://feed.craftedsignal.io/briefs/2026-10-mcp-sdk-message-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Sdk-Vulnerability","version":"https://jsonfeed.org/version/1.1"}