CVE-2026-25536: 
Wolfi vulnerability analysis and mitigation

CVE-2026-25536 is a cross-client response data leak vulnerability in the MCP TypeScript SDK (@modelcontextprotocol/sdk), the official TypeScript SDK for Model Context Protocol servers and clients. It affects versions 1.10.0 through 1.25.3 and arises when a single McpServer/Server or StreamableHTTPServerTransport instance is reused across multiple client connections — a pattern most common in stateless StreamableHTTPServerTransport deployments. The vulnerability was published on February 4, 2026, and patched in version 1.26.0. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The vulnerability encompasses two distinct but related race condition issues (CWE-362, CWE-367). Issue 1 (Transport re-use): When a single StreamableHTTPServerTransport instance handles multiple concurrent client requests, JSON-RPC message ID collisions occur because MCP client SDKs use an incrementing counter starting at 0. The second client's request overwrites the first client's requestId → stream mapping entry, causing responses to be routed to the wrong HTTP connection. Issue 2 (Server/Protocol re-use): When a single McpServer is connect()ed to multiple transports, the Protocol's internal this._transport reference is silently overwritten by each new connection. Any server-to-client messages sent during request handling (progress notifications, sampling requests, elicitation) are dispatched through this shared reference, which may point to a different client's transport. Both issues require two or more concurrent clients with overlapping JSON-RPC message IDs to trigger silent data misrouting (GitHub Advisory, Security Advisory).

Successful exploitation results in high confidentiality impact and low integrity impact: one authenticated client can receive response data — including tool call results (tools/call), resource reads (resources/read), prompt responses (prompts/get), progress notifications, and sampling/elicitation messages — intended for a different client. In multi-tenant or multi-user MCP deployments, this means sensitive AI-generated outputs, tool execution results, or internal resource data from one user's session can be silently exposed to another user. The requesting client whose data was misrouted will experience a timeout, potentially revealing the anomaly. IBM watsonx Orchestrate with watsonx Assistant Cartridge is among the affected downstream products (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated network attacker (low privileges required) who can send concurrent requests to a vulnerable stateless MCP server deployment; no user interaction is needed. The attack is most reliably triggered in stateless deployments where both the transport and server instances are shared across requests (GitHub Advisory).

1. Identify a vulnerable target: Locate an MCP server deployment using @modelcontextprotocol/sdk versions 1.10.0–1.25.3 in stateless mode (i.e., StreamableHTTPServerTransport without sessionIdGenerator, reusing a single server/transport instance across requests).
2. Obtain valid credentials: Acquire low-privilege credentials sufficient to authenticate to the MCP server endpoint (e.g., an API key or user account in a multi-tenant application).
3. Establish concurrent connections: Open two or more simultaneous HTTP connections to the MCP server endpoint (e.g., /mcp) as different clients.
4. Send overlapping JSON-RPC requests: From each client, send a JSON-RPC request (e.g., tools/call, resources/read) immediately after the other. Because the SDK's default client uses an incrementing counter starting at 0, both clients will generate identical message IDs (e.g., id: 1) on their first requests.
5. Trigger ID collision: The second client's request overwrites the first client's requestId → stream mapping in the shared transport, causing the server's response to be routed to the attacker's HTTP stream instead of the legitimate client's.
6. Receive misrouted data: The attacker's connection receives the response data (tool output, resource content, etc.) intended for the victim client, while the victim's request times out (GitHub Advisory, Security Advisory).

• Network: Unusual pattern of concurrent HTTP POST requests to the MCP endpoint (e.g., /mcp) from multiple source IPs or sessions arriving within milliseconds of each other; one client connection receiving a response followed immediately by a timeout on another client's connection.
• Logs: Application logs showing JSON-RPC message ID collisions or duplicate IDs across different client sessions; server-side errors such as Protocol already connected or Transport already used after upgrading to v1.26.0 (indicating the server was previously misconfigured); client-side timeout errors on requests that should have succeeded.
• Application Behavior: Reports from users of a multi-tenant MCP application that they received unexpected or incorrect data in tool/resource responses; one user's session timing out while another receives an unexpected response payload (GitHub Advisory).

Upgrade @modelcontextprotocol/sdk to version 1.26.0 or later, which adds runtime guards: Protocol.connect() now throws if already connected (preventing silent transport overwriting), and stateless StreamableHTTPServerTransport.handleRequest() throws if called more than once per instance. If immediate upgrade is not possible, the workaround is to create fresh McpServer and StreamableHTTPServerTransport instances for every incoming request (stateless mode) or every new session (stateful mode), ensuring no shared state exists between client connections. IBM watsonx Orchestrate with watsonx Assistant Cartridge users should consult the IBM security bulletin for product-specific remediation guidance (GitHub Advisory, IBM Advisory).

The vulnerability attracted notable commentary in the AI/MCP security community. Several security researchers published analyses on dev.to and Telegraph highlighting it as part of a broader pattern of MCP SDK security issues, with posts such as "The MCP SDK Is Now Its Own Attack Surface" and "When MCP Becomes a Corporate Backdoor" referencing CVE-2026-25536 alongside related MCP CVEs. A Substack post titled "MCP Security Crisis: 30 CVEs in 60 Days" cited this vulnerability as part of a wave of MCP ecosystem security disclosures. Community discussion on GitHub (issues #204 and #243) predated the formal advisory, with developers independently discovering the multi-client routing problem in early 2025. The OWASP AISVS project also referenced the issue in its tracking of AI security vulnerabilities (dev.to/kai_security_ai, Substack).