MCP SDK 1.32.0 Enforces Session-Tied Tasks to Block Cross-Client Access in CVE-2026-111767
A high-severity flaw in the MCP SDK allowed shared clients to access each other’s tasks. Version 1.32.0 patches the issue by tying tasks to their creating sessions.
Key points
- CVE-2026-111767 affects MCP SDK versions 1.24.0 through 1.31.0, rated high severity with a CVSS score of 8.6.
- The vulnerability allowed clients sharing an InMemoryTaskStore to list, read, and cancel tasks created by other sessions.
- Version 1.32.0 resolves the issue by enforcing session-specific task isolation, while the experimental feature itself is deprecated.
An attacker exploiting CVE-2026-111767 gains unauthorized access to task data belonging to other users within the same server environment. According to the GitHub advisory, this requires clients to share one InMemoryTaskStore. Once connected, the adversary can list, read, and cancel tasks they did not create, bypassing intended session boundaries.
In plain English
The Model Context Protocol (MCP) SDK allows software to manage tasks through a feature called taskStore. In vulnerable versions, this feature failed to verify which user session created a specific task. Consequently, any client connected to the same shared memory store could see and manipulate tasks from other sessions. This breaks the fundamental expectation that user sessions remain isolated from one another.
The background
The vulnerability exists in the @modelcontextprotocol/sdk package for npm, specifically versions 1.24.0 through 1.31.0. The National Vulnerability Database rates the issue as high severity, citing CWE-639 and CWE-862. The 2.x packages are not affected. The experimental tasks feature is now deprecated, as the July 28, 2026 specification replaced it with a redesigned extension.
What changes now
Developers using the affected SDK must upgrade to version 1.32.0 to patch the flaw. This update ensures each task is tied to the session that created it, preventing cross-session access. If upgrading is not immediately possible, the advisory recommends removing the taskStore or creating a separate InMemoryTaskStore for each session to maintain isolation.
What made it possible
Session isolation failures occur when systems fail to enforce boundaries between distinct user contexts. Attackers exploit this by leveraging shared resources, such as memory stores or databases, to access data intended for other sessions. This technique typically serves the lateral movement or data theft phase of an intrusion. Teams should verify that all shared components enforce strict ownership checks. Ensure that session identifiers are validated before granting access to any stored data or task state.
What to do and how to stay safe: MCP SDK
- Scan your codebase for references to taskStore to determine if you are using the vulnerable experimental feature.
- Upgrade the @modelcontextprotocol/sdk package to version 1.32.0 or later to apply the official patch.
- If you cannot upgrade, configure your server to create a unique InMemoryTaskStore for each individual session.
- Remove the experimental tasks feature entirely, as it is deprecated and replaced by newer specifications.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the MCP SDK 2.x series affected by CVE-2026-111767?
No, the 2.x packages are not affected by this vulnerability, which only impacts versions 1.24.0 through 1.31.0.
How can I check if my project is vulnerable?
You can run a grep command for taskstore in your project directory, excluding node_modules, to see if the feature is in use.
What is the recommended long-term fix for this issue?
The best course of action is to stop using the experimental tasks feature, as it has been deprecated in favor of a redesigned extension.
