MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
影響: npm:@modelcontextprotocol/sdk >= 1.24.0, < 1.32.0 → 1.32.0
In affected versions, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redesigned extension. The best course of action is to stop using them. Am I affected? Only if your HTTP server passes taskStore to McpServer or Server. If grep -ri taskstore --exclude-dir=node_modules . finds no…
| CVE | CVE-2026-111767 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 10. 21. 오전 03:26, GitHub Advisory Database에서 "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-111767.