Detections
Analytics

SCA: security update for @modelcontextprotocol/server (GHSA-jm63-cq47-j5jp)

high Tenable Self-Hosted Container Security Plugin ID 476356

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the
 Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared
 one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver
 responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP
 by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were
 associated with a connection using only the JSON-RPC request identifier. SDK clients start request
 identifiers at zero, so collisions occur in normal operation. Cross-client delivery exposes one client's
 responses and notifications to another client. The issue requires an HTTP endpoint reachable by more than
 one client and an application that constructs the server or transport once at startup instead of once per
 request or session. stdio servers and factory-created per-call servers are not affected. Upgrading causes
 reused instances to fail and therefore requires an application code change. This issue is fixed in
 @modelcontextprotocol/server 2.3.0. (CVE-2026-111770)

Solution

Update the @modelcontextprotocol/server library and its related packages to version 2.3.0 or later.

See Also

https://github.com/advisories/GHSA-jm63-cq47-j5jp

Plugin Details

Severity: High

ID: 476356

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 10/20/2026

Updated: 11/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.82

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.3

Temporal Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:C

CVSS Score Source: CVE-2026-111770

CVSS v3

Risk Factor: High

Base Score: 7.7

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 10/20/2026

Reference Information

CVE: CVE-2026-111770

cwe: CWE-362