Read the docs
TI-2026-85674 Aliases CVE-2026-111770

Model Context Protocol SDK sends responses to the wrong HTTP client

Priority LOW 34CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

The Model Context Protocol TypeScript SDK before 1.32.0, and @modelcontextprotocol/server from 2.0.0 before 2.3.0, can deliver responses and notifications to the wrong HTTP client. Messages are matched to connections using only the JSON-RPC request identifier, and because SDK clients start these identifiers at zero, collisions occur in normal operation (CWE-362). An attacker needs no privileges or user interaction, but the flaw requires an HTTP endpoint shared by several clients where the server or transport is constructed once at startup and reused.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK clients start request identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than one client and an application that constructs the server or transport once at startup instead of once per request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes reused instances to fail and therefore requires an application code change. This issue is fixed in @modelcontextprotocol/server 2.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed typescript-sdk (modelcontextprotocol): 1.32.0server (@modelcontextprotocol): 2.3.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowtypescript-sdkbefore 1.32.01.32.0Patch availableCNA
MLflowserver2.0.0 to before 2.3.02.3.0Patch availableCNA
—@modelcontextprotocol/server (npm)2.0.0 to before 2.3.02.3.0Patch availableGHSA-jm63-cq47-j5jp
  • typescript-sdk VendorMLflow Affected before 1.32.0 Fixed in 1.32.0 Patch available CNA
  • server VendorMLflow Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
  • @modelcontextprotocol/server (npm) Vendor— Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-jm63-cq47-j5jp

Remediation

Upgrade the Model Context Protocol TypeScript SDK to 1.32.0 and @modelcontextprotocol/server to 2.3.0. Applications that reuse one server or transport instance must change their code to construct it once per request or session, because upgrading makes reused instances fail.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA typescript-sdk (modelcontextprotocol) Fixed in 1.32.0
  • Fix · CNA server (@modelcontextprotocol) Fixed in 2.3.0
  • Fix · GHSA-jm63-cq47-j5jp @modelcontextprotocol/server (npm) Fixed in 2.3.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-111770
  2. 2026-11-05 CISA SSVC decision points changed
  3. 2026-11-05 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 6

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences