CVE-2026-111771

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111771", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-16T17:52:09.082Z", "datePublished": "2026-11-05T21:08:55.758Z", "dateUpdated": "2026-11-10T04:21:21.841Z"}, "containers": {"cna": {"title": "Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2929", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2930", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2952", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"}], "affected": [{"vendor": "modelcontextprotocol", "product": "typescript-sdk", "versions": [{"version": ">= 1.6.0, < 1.32.0", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "sdk", "versions": [{"version": ">= 1.6.0, < 1.32.0", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "server", "versions": [{"version": ">= 2.0.0, < 2.3.0", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "express", "versions": [{"version": ">= 2.0.0, < 2.0.2", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "server-legacy", "versions": [{"version": ">= 2.0.0, < 2.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T21:08:55.758Z"}, "descriptions": [{"lang": "en", "value": "The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}], "source": {"advisory": "GHSA-rvq5-wwqv-78pq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T04:21:00.140745Z", "id": "CVE-2026-111771", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:21:21.841Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111771", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-16T17:52:09.082Z", "datePublished": "2026-11-05T21:08:55.758Z", "dateUpdated": "2026-11-10T04:21:21.841Z"}, "containers": {"cna": {"title": "Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2929", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2930", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2952", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"}, {"name": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"}], "affected": [{"vendor": "modelcontextprotocol", "product": "typescript-sdk", "versions": [{"version": ">= 1.6.0, < 1.32.0", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "sdk", "versions": [{"version": ">= 1.6.0, < 1.32.0", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "server", "versions": [{"version": ">= 2.0.0, < 2.3.0", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "express", "versions": [{"version": ">= 2.0.0, < 2.0.2", "status": "affected"}]}, {"vendor": "@modelcontextprotocol", "product": "server-legacy", "versions": [{"version": ">= 2.0.0, < 2.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T21:08:55.758Z"}, "descriptions": [{"lang": "en", "value": "The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}], "source": {"advisory": "GHSA-rvq5-wwqv-78pq", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111771", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-10T04:21:00.140745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:21:15.669Z"}}]}}

{"affected": [{"affectedData": [{"product": "typescript-sdk", "vendor": "modelcontextprotocol", "versions": [{"status": "affected", "version": ">= 1.6.0, < 1.32.0"}]}, {"product": "sdk", "vendor": "@modelcontextprotocol", "versions": [{"status": "affected", "version": ">= 1.6.0, < 1.32.0"}]}, {"product": "server", "vendor": "@modelcontextprotocol", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.3.0"}]}, {"product": "express", "vendor": "@modelcontextprotocol", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.0.2"}]}, {"product": "server-legacy", "vendor": "@modelcontextprotocol", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.3.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}], "id": "CVE-2026-111771", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111771", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T04:21:00.140745Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:35.973", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@modelcontextprotocol/sdk: @modelcontextprotocol/server: @modelcontextprotocol/express: @modelcontextprotocol/server-legacy: Model Context Protocol TypeScript SDK: Authentication bypass via missing token audience validation", "id": "2567830", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567830"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-303", "details": ["A flaw was found in the Model Context Protocol (MCP) TypeScript SDK. The server-side authentication mechanism fails to verify that incoming access tokens were specifically issued for the target server. A remote attacker with a valid token issued for another service within the same authorization environment can exploit this issue to bypass authentication and gain unauthorized access to server resources."], "mitigation": {"lang": "en:us", "value": "Validate the token audience within the application's token verification callback:\nConfigure the application's `verifyAccessToken()` handler to inspect the `aud` (audience) claim of incoming bearer tokens and reject any token that does not explicitly match the expected identifier or URL of the target service.\nImplementing this manual check prevents tokens issued for other services from granting access. The affected application service must be restarted for configuration and code changes to take effect."}, "name": "CVE-2026-111771", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-05T21:08:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111771\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111771\nhttps://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a\nhttps://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f\nhttps://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325\nhttps://github.com/modelcontextprotocol/typescript-sdk/pull/2929\nhttps://github.com/modelcontextprotocol/typescript-sdk/pull/2930\nhttps://github.com/modelcontextprotocol/typescript-sdk/pull/2952\nhttps://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0\nhttps://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2\nhttps://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1\nhttps://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0\nhttps://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"], "statement": "This vulnerability is rated as having a Moderate impact because exploitation requires specific architectural preconditions, namely an authorization server that issues tokens for multiple disparate services and an attacker who already holds a valid access token for another service. Deployments are unaffected if the application independently verifies the intended recipient of incoming tokens. Furthermore, the issue only affects server-side HTTP bearer authentication implementations where audience validation has not been explicitly configured.", "threat_severity": "Moderate"}

{"created": "2026-11-05T22:30:17.931977+00:00", "updated": "2026-11-06T13:30:05.090184+00:00", "vendors": []}