CVE-2026-111770: 
JavaScript Schwachstellenanalyse und -minderung

CVE-2026-111770 is a message routing flaw in the MCP TypeScript server SDK (@modelcontextprotocol/server) that allows one HTTP client's responses and notifications to be delivered to another client. The vulnerability affects versions 2.0.0 through 2.2.0 of @modelcontextprotocol/server and arises when a shared McpServer or Server instance (or a shared stateless transport) is used across multiple HTTP connections. It was published on October 15, 2026, and added to the GitHub Advisory Database on October 20, 2026. The CVSS v3.1 base score is 7.7 (High) (GitHub Advisory, Security Advisory).

The root cause is improper synchronization when a shared resource (a single McpServer/Server instance or a stateless transport) is reused across concurrent HTTP connections, classified as CWE-362 (Race Condition). Messages are matched to a connection using the JSON-RPC id field alone, and because SDK clients number requests starting from 0, ID collisions occur in normal concurrent use — causing responses intended for one client to be routed to another. The vulnerability is triggered when the transport or server object is instantiated once at startup (a pattern explicitly shown in the official README examples for @modelcontextprotocol/hono, express, fastify, and node) rather than once per request or per session. Exploitation requires that more than one client can reach the same HTTP endpoint simultaneously (GitHub Advisory, Fix PR).

Successful exploitation allows an attacker to intercept responses and notifications intended for other clients connected to the same MCP server, resulting in high confidentiality impact (exposure of another client's data), low integrity impact (potential to act on misdirected responses), and high availability impact (disrupted service for legitimate clients). In multi-tenant or shared MCP deployments, this could expose sensitive tool outputs, AI model responses, or session-specific data to unauthorized parties. The vulnerability does not require authentication or user interaction, making it particularly dangerous in publicly accessible MCP HTTP endpoints (GitHub Advisory, Security Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed at the time of this report, and the CVE status remains "Reserved." The vulnerability has an EPSS score that is not yet published. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, a PoC probe tool (mcp-idprobe) appeared on GitHub shortly after disclosure, suggesting active community interest in testing the flaw (GitHub Advisory). Exploitation requires concurrent access from multiple clients to the same HTTP endpoint, which is a realistic condition in any shared or multi-tenant MCP deployment.

1. Reconnaissance: Identify an HTTP-accessible MCP server endpoint (e.g., /mcp) running @modelcontextprotocol/server versions 2.0.0–2.2.0, where the server or transport is instantiated once at startup rather than per request.
2. Establish concurrent connections: Open two or more simultaneous HTTP connections to the MCP endpoint from different clients (or simulate this with concurrent requests from a single attacker-controlled client).
3. Send overlapping JSON-RPC requests: Issue JSON-RPC requests from both clients. Since SDK clients number requests starting from id: 0, both clients will send requests with the same id values (e.g., {"id": 0, "method": "tools/list", ...}).
4. Intercept misdirected responses: Due to the shared transport/server instance matching responses by id alone, the server routes one client's response to the other client's connection. The attacker receives responses (including sensitive tool outputs or notifications) intended for the victim client.
5. Exfiltrate data: Collect the intercepted responses, which may contain sensitive AI model outputs, tool results, or session-specific data from the victim client (GitHub Advisory, Fix PR).

• Network: Concurrent HTTP POST requests to the MCP endpoint (e.g., /mcp) from multiple source IPs arriving within the same time window; unexpected or mismatched JSON-RPC id values in server responses relative to the originating client's requests.
• Logs: Server-side logs showing multiple simultaneous connections to the MCP HTTP endpoint; HTTP 500 responses after upgrading to 2.3.0 (indicating an app still using a shared server/transport instance); JSON-RPC error -32603 (Internal server error) in response logs for overlapping requests.
• Process/Application: connect() rejections with ALREADY_CONNECTED error code in application logs after upgrading; Stateless transport cannot be reused across requests error messages in Node.js process output.
• File System: Presence of the mcp-idprobe tool or similar scanning utilities on systems that interact with MCP endpoints (Fix PR, GitHub Advisory).

Upgrade @modelcontextprotocol/server to version 2.3.0 or later, which enforces that a Server or McpServer instance serves only one connection at a time and a stateless transport handles only one request (GitHub Advisory). Code changes are also required: after upgrading, applications must be refactored to instantiate a new McpServer and transport per request (or per session using sessionIdGenerator), rather than sharing a single instance across all requests. For createMcpHandler(), pass a factory function that builds a new McpServer on every call. If upgrading immediately is not possible, the same code-level fix (instantiating per request/session) resolves the vulnerability in affected versions as well (Fix Commit, Security Advisory).

The vulnerability was reported by researchers DavidCarliez and legitu1337 and published by maxisbey on October 15, 2026 (Security Advisory). A community blog post titled "Whose response is this? The MCP server SDK that matched replies by ID alone" appeared on dev.to shortly after disclosure, highlighting the practical risk of the shared-instance pattern promoted by official README examples. The fix was implemented via an AI-assisted pull request (generated with Claude Code) and merged by Felix Weinberger, drawing attention to the role of AI-generated code in both introducing and resolving SDK-level security issues (Fix PR).