{"id":"EM-20261105-EB6J","url":"https://cyber.eventmonitor.net/incident/EM-20261105-EB6J/modelcontextprotocol-server-vulnerability-cve-2026-111770/","type":"cve","title":"@modelcontextprotocol/server Vulnerability (CVE-2026-111770)","subtitle":"CVE-2026-111770","subject":"CVE-2026-111770","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T22:17:45.817Z","firstSignal":"2026-11-05T21:28:00.000Z","lastSignal":"2026-11-05T22:17:45.817Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T22:17:45.817Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T22:17:45.817Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T21:28:00.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T22:17:45.817Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-EB6J created."},{"at":"2026-11-05T22:17:45.817Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-05T22:17:45.817Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T22:17:45.817Z","detail":"CVSS 7.7"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T21:28:00.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T21:28:00.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-111770 (moderate)","text":"@modelcontextprotocol/server: @modelcontextprotocol/server: Information disclosure via shared HTTP transport instance","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-111770.json"},{"at":"2026-11-05T22:17:45.817Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-111770 (CVSS 7.7)","text":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients could deliver responses and notifications to the wrong client. The affected surface is an MCP server reached over HTTP by multiple clients. The trigger is reuse of one stateless transport or server instance. Messages were associated with a connection using only the JSON-RPC request identifier. SDK…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111770"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T22:17:45.817","score":7.7,"severity":"HIGH","desc":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients…","product":"","seen":1793930371444},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}