CVE-2026-111767: 
Grafana vulnerability analysis and mitigation

CVE-2026-111767 is an authorization bypass vulnerability in the MCP TypeScript SDK (@modelcontextprotocol/sdk), the official TypeScript SDK for Model Context Protocol servers and clients. The experimental taskStore feature (InMemoryTaskStore) failed to associate tasks with the session that created them, allowing any connected client to list, read, and cancel tasks belonging to other clients. Affected versions are >= 1.24.0 and < 1.32.0; the 2.x package line is not affected. The vulnerability was published on October 2, 2026, and added to the GitHub Advisory Database on October 20, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (Github Advisory).

The root cause is a missing authorization check (CWE-862) combined with an authorization bypass through a user-controlled key (CWE-639) in the InMemoryTaskStore implementation. All TaskStore interface methods (getTask, getTaskResult, updateTaskStatus, storeTaskResult, listTasks) accepted an optional sessionId parameter but the InMemoryTaskStore implementation ignored it entirely — tasks were stored and retrieved using only their task ID, with no session binding. As a result, any network-accessible client that could guess or enumerate a task ID could invoke tasks/get, tasks/list, tasks/result, or tasks/cancel against tasks created by a completely different session. The fix in PR #2925 introduced a private lookup() helper that enforces session ownership: if a stored task has a sessionId and the caller presents a different one, the task is treated as not found (Github Advisory, Fix PR, Fix Commit).

Any unauthenticated client connected to an HTTP MCP server that uses a shared InMemoryTaskStore can enumerate, read, and cancel tasks created by other clients in different sessions, resulting in high confidentiality impact (exposure of task data and results from other sessions), low integrity impact (ability to cancel or disrupt another session's tasks), and low availability impact (disruption of task workflows). The vulnerability is exploitable without any privileges or user interaction, making it particularly dangerous in multi-tenant or shared MCP server deployments. Sensitive data processed by AI agents and passed through task results — which may include tool outputs, model responses, or business logic data — could be exposed to unauthorized parties (Github Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is rated as automatable (no privileges, no user interaction, network-accessible), meaning a scanning or scripted attack could systematically enumerate task IDs and harvest cross-session data at scale.

1. Identify a vulnerable target: Locate an HTTP-based MCP server running @modelcontextprotocol/sdk versions 1.24.0–1.31.0 that has taskStore configured (i.e., passes an InMemoryTaskStore to McpServer or Server). Confirm by checking if the server exposes task-related MCP endpoints (tasks/list, tasks/get, tasks/result, tasks/cancel).
2. Establish a legitimate client session: Connect to the MCP server as a normal client to obtain a valid session. This requires no special privileges.
3. Enumerate tasks via tasks/list: Send a tasks/list MCP request. Because InMemoryTaskStore did not filter by session, the response will include tasks created by all other connected sessions, not just the attacker's own.
4. Read cross-session task data: Use the task IDs returned in step 3 to call tasks/get or tasks/result for tasks belonging to other sessions, retrieving their full task parameters, status, and results — which may contain sensitive tool outputs or model responses.
5. Cancel or disrupt other sessions' tasks: Optionally call tasks/cancel with a cross-session task ID to disrupt another client's ongoing workflow, achieving a denial-of-service effect against that session (Github Advisory, Fix PR).

• Network: Unusual volume of tasks/list requests from a single client session, especially shortly after connection establishment; tasks/get or tasks/result requests referencing task IDs not created by the requesting session.
• Logs: MCP server access logs showing a client session calling tasks/list and then immediately calling tasks/get/tasks/result/tasks/cancel on task IDs that belong to other sessions; repeated tasks/cancel calls from a session that did not create the cancelled tasks.
• Application Behavior: Tasks being cancelled unexpectedly without action from the session that created them; task result data appearing to be accessed by sessions that should not have visibility into those tasks.

Primary fix: Upgrade @modelcontextprotocol/sdk to version 1.32.0 or later, which ties each task to the session that created it via the updated InMemoryTaskStore (Github Advisory, Fix Commit).

Workarounds if immediate upgrade is not possible:

• Remove the taskStore parameter from McpServer/Server configuration entirely to disable the vulnerable feature.
• Create one InMemoryTaskStore instance per session rather than sharing a single store across all sessions.
• Long-term: The experimental tasks feature is deprecated and replaced by a redesigned extension in the 2026-07-28 MCP specification; discontinuing use of taskStore altogether is the recommended long-term approach.

To check if you are affected, run: grep -ri taskstore --exclude-dir=node_modules . — if no results are found, your deployment is not vulnerable.

The vulnerability was reported by security researcher cipher-creator and published by maxisbey to the GitHub Advisory Database on October 2, 2026 (Github Advisory). Social media activity was observed on Mastodon (via @thehackerwire) and Bluesky shortly after disclosure, indicating moderate community awareness. Tenable added a cloud security plugin (ID 476364) for detection. The issue attracted attention in the MCP developer community given the growing adoption of the Model Context Protocol in AI agent frameworks.