CVE-2026-111770

Shared MCP server instances can mix clients’ responses

Model Context Protocol maintainers · MCP TypeScript HTTP server

First documented disclosure · Review checkpoint

Summary

One HTTP client can receive another client’s messages when applications share server or transport objects.

Severity and exploitation evidence

High · 7.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer documents tests and cross-client routing behavior; no malicious victim incident is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Connections are matched using colliding JSON-RPC request IDs while a stateless transport or server is reused across clients.

Conditions required

Multiple clients reach an HTTP endpoint whose implementation reuses one transport or server instance.

Potential impact

Cross-client response/notification disclosure or interference; correct per-request or per-session isolation is unaffected.

Affected versions and configurations

Maintainer: @modelcontextprotocol/server 2.0.0–2.2.0. It explicitly excludes SDK 1.26.0 and later; the CNA’s broader SDK <1.32.0 metadata conflicts.

Fix and mitigation status

Server 2.3.0 rejects unsafe instance reuse; applications must also create isolated instances.

Practical next steps

Upgrade and construct a server/transport per request or per session, or supply a factory to createMcpHandler. Test concurrent clients; unsafe code can fail requests after upgrading.

Operating lesson

Request identifiers are not tenant identities.

Evidence and limits

The October 2 public patch predates the October 15 advisory and November 5 CNA. Stdio is unaffected. The current maintainer’s narrower 1.x statement is preserved rather than silently accepting contradictory registry metadata.

Sources