MCP server SDK CVE-2026-111770: shared McpServer leaks responses across clients
Future_AGI · reddit · 2026-10-21
A deep dive into CVE-2026-111770 (high, 7.7) in modelcontextprotocol/server 2.0.0–2.2.0: README templates create one module-level McpServer, and JSON-RPC id collisions let one client receive another's tool results. The 2.3.0 fix surfaces as ALREADYCONNECTED errors on upgrade. Correct patterns: per-request servers, per-session transports via sessionIdGenerator, or createMcpHandler with a builder. Also covers CVE-2026-111771 (missing audience check) and CVE-2026-104850 (OAuth credential leakage) with concrete remediation steps.
More from coding & agent
- Voice agent developers wrestle with the hardest edge case: knowing when to hang up — Kindly-Duty272 · 2026-10-21
- OpenCode hacked, eMudra used private key of 4, PHP hit by supply-chain chaos — burny_tech · 2026-10-21
- PHP ships emergency fixes for two 9.2/10 RCE vulnerabilities — MickeySteamboat · 2026-10-21
- Anthropic releases Claude Sonnet 5.5: Terminal-Bench jumps from 10.3% to 70.6%, tasks up to 30% cheaper — Aiden_Tech_Ai · 2026-10-21
- Indie hacker ships 8 email product features in one drop with Opus, shares inbox open-rate data — marclou · 2026-10-21
- Solo dev runs 6,000+ unattended news episodes in 19 months — eval loops, not models — jwdNyc · 2026-10-21