MCP TypeScript SDK accepts bearer tokens issued for other services
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Affected are @modelcontextprotocol/sdk from 1.6.0 before 1.32.0, @modelcontextprotocol/server from 2.0.0 before 2.3.0, @modelcontextprotocol/express from 2.0.0 before 2.0.2, and @modelcontextprotocol/server-legacy from 2.0.0 before 2.3.1. Server-side bearer authentication accepts a token issued for another service (CWE-863), letting a remote attacker with one gain an authenticated caller's capabilities. It applies when the authorization server issues tokens for several services.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | typescript-sdk | 1.6.0 to before 1.32.0 | 1.32.0 | Patch available | CNA |
| MLflow | sdk | 1.6.0 to before 1.32.0 | 1.32.0 | Patch available | CNA |
| MLflow | server | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | CNA |
| MLflow | express | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | CNA |
| MLflow | server-legacy | 2.0.0 to before 2.3.1 | 2.3.1 | Patch available | CNA |
| — | @modelcontextprotocol/sdk (npm) | 1.6.0 to before 1.32.0 | 1.32.0 | Patch available | GHSA-rvq5-wwqv-78pq |
| — | @modelcontextprotocol/server (npm) | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | GHSA-rvq5-wwqv-78pq |
| — | @modelcontextprotocol/express (npm) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-rvq5-wwqv-78pq |
| — | @modelcontextprotocol/server-legacy (npm) | 2.0.0 to before 2.3.1 | 2.3.1 | Patch available | GHSA-rvq5-wwqv-78pq |
- typescript-sdk VendorMLflow Affected 1.6.0 to before 1.32.0 Fixed in 1.32.0 Patch available CNA
- sdk VendorMLflow Affected 1.6.0 to before 1.32.0 Fixed in 1.32.0 Patch available CNA
- server VendorMLflow Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
- express VendorMLflow Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available CNA
- server-legacy VendorMLflow Affected 2.0.0 to before 2.3.1 Fixed in 2.3.1 Patch available CNA
- @modelcontextprotocol/sdk (npm) Vendor— Affected 1.6.0 to before 1.32.0 Fixed in 1.32.0 Patch available GHSA-rvq5-wwqv-78pq
- @modelcontextprotocol/server (npm) Vendor— Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-rvq5-wwqv-78pq
- @modelcontextprotocol/express (npm) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-rvq5-wwqv-78pq
- @modelcontextprotocol/server-legacy (npm) Vendor— Affected 2.0.0 to before 2.3.1 Fixed in 2.3.1 Patch available GHSA-rvq5-wwqv-78pq
Remediation
Upgrade @modelcontextprotocol/sdk to 1.32.0, @modelcontextprotocol/server to 2.3.0, @modelcontextprotocol/express to 2.0.2, and @modelcontextprotocol/server-legacy to 2.3.1. Upgrading alone leaves the new audience validation disabled, so operators must enable audience validation and provide the token audience together.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA typescript-sdk (modelcontextprotocol) Fixed in 1.32.0
- Fix · CNA sdk (@modelcontextprotocol) Fixed in 1.32.0
- Fix · CNA server (@modelcontextprotocol) Fixed in 2.3.0
- Fix · CNA express (@modelcontextprotocol) Fixed in 2.0.2
- Fix · CNA server-legacy (@modelcontextprotocol) Fixed in 2.3.1
- Fix · GHSA-rvq5-wwqv-78pq @modelcontextprotocol/sdk (npm) Fixed in 1.32.0 Advisory →
- Fix · GHSA-rvq5-wwqv-78pq @modelcontextprotocol/server (npm) Fixed in 2.3.0 Advisory →
- Fix · GHSA-rvq5-wwqv-78pq @modelcontextprotocol/express (npm) Fixed in 2.0.2 Advisory →
- Fix · GHSA-rvq5-wwqv-78pq @modelcontextprotocol/server-legacy (npm) Fixed in 2.3.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-11-05 Threatist record created from CVE-2026-111771
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 12
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2929
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2930
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2952
- https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a
- https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f
- https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/[email protected]
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/[email protected]
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/[email protected]
- https://github.com/modelcontextprotocol/typescript-sdk
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-111771 · CVE Program
- CVE-2026-111771 · NVD
- FIRST EPSS
- CVE-2026-111771 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences