MCP TypeScript SDK servers using experimental tasks let one client read and cancel another client's tasks
On October 20, 2026, CVE-2026-111767 was published for @modelcontextprotocol/sdk from 1.24.0 before 1.32.0. The SDK's experimental tasks feature did not check which session created a task, so clients sharing one InMemoryTaskStore could list, read, and cancel each other's tasks. Only HTTP servers that pass taskStore are affected. The record rates it High, CVSS 3.1 score 8.6, and it is fixed in 1.32.0 (advisory published October 2, 2026).
What was reported
CVE-2026-111767 was published October 20, 2026. The record, from GitHub, says that in the MCP TypeScript SDK from 1.24.0 to before 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read, and cancel each other's tasks. It names CWE-639 and CWE-862 and rates it High, CVSS 3.1 score 8.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. NVD carries the same description.
The SDK's advisory, GHSA-22jm-h49p-29qw, was published October 2, 2026. It says you are affected only if your HTTP server passes taskStore to McpServer or Server, and that if grep -ri taskstore --exclude-dir=node_modules . finds nothing, you are not affected. The affected versions are @modelcontextprotocol/sdk 1.24.0 through 1.31.0. The 2.x packages are not affected.
The fix is @modelcontextprotocol/sdk 1.32.0. The advisory says each task is now tied to the session that created it, so a client that starts a new session can no longer reach its earlier tasks. It also says experimental tasks are deprecated, that the 2026-07-28 specification replaced them with a redesigned extension, and it recommends discontinuing experimental tasks. If you cannot upgrade yet, remove taskStore or create one InMemoryTaskStore per session.
How to prevent it
Run grep -ri taskstore --exclude-dir=node_modules . in your MCP server project. If it finds nothing, this bug does not affect you. If it does, upgrade @modelcontextprotocol/sdk to 1.32.0 or later, or remove taskStore. The advisory says experimental tasks are deprecated, and that one InMemoryTaskStore per session is the stopgap if you cannot upgrade yet.
Sources
Related
Incidents on the same topics
- A crafted URL could run PowerShell on Windows through the open package, and MCP Inspector and OpenCode were affected
- Google's Cloud Run MCP server could send your source code to a storage bucket an attacker set up first
- Better Auth accepted an OAuth sign-in state as a Magic Link token, so knowing a user's email was enough to sign in as them
- One compressed request can crash a Node.js app that uses body-parser with default options
Guides for the same stack
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.