MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From
    version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which
    session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's
    tasks. This issue has been patched in version 1.32.0. (CVE-2026-111767)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From     version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which     session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's     tasks. This issue has been patched in version 1.32.0. (CVE-2026-111767)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
476572	Chainguard: multiple kibana-9.3 packages: security update to 9.3.8-r7	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
476572	Chainguard: multiple kibana-9.3 packages: security update to 9.3.8-r7	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
369507	Linux Distros Unpatched Vulnerability : CVE-2026-111767	Nessus	Misc.	Local	high
476364	SCA: security update for @modelcontextprotocol/sdk (GHSA-22jm-h49p-29qw)	Tenable Cloud Security	SCA Checks	Local	high
476364	SCA: security update for @modelcontextprotocol/sdk (GHSA-22jm-h49p-29qw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-111767

high

Tenable Plugins

high

high

high

high

high