7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25536

CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25536

CVE-2026-25536:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@modelcontextprotocol/sdk	npm	>= 1.10.0, <= 1.25.3	1.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described in the advisory, is a cross-client data leak in @modelcontextprotocol/sdk. It occurs when a single McpServer or StreamableHTTPServerTransport instance is reused across multiple client connections, a common pattern in stateless server deployments. This reuse leads to JSON-RPC message ID collisions, causing the server to route responses to the wrong client.

To identify the vulnerable functions, I first determined the patched version (1.26.0) and the last vulnerable version (1.25.3). By comparing the git tags for these versions, I identified the commits included in the patch. The key commit, a05be176cabeae1f933b676e3ce024bf02e2314d, has a very descriptive message: "fix: add transport isolation guards to prevent cross-client data leaks".

This commit message explicitly states the two main changes made to fix the vulnerability:

Protocol.connect() was modified to throw an error if it's called on an already connected protocol.
StreamableHTTPServerTransport.handleRequest() was modified to throw an error if called more than once on the same instance in stateless mode.

These changes directly address the root cause of the vulnerability, which is the improper reuse of objects. The functions Protocol.connect and StreamableHTTPServerTransport.handleRequest are the points where this reuse manifests and causes the data leak. Therefore, these are the key functions that would appear in a runtime profile during the exploitation of this vulnerability. The exploit scenario involves concurrent calls to these functions on shared objects, leading to the misrouting of data.

Vulnerable functions

Protocol.connect

packages/sdk/src/protocol.ts

This function was vulnerable because it allowed a `Protocol` instance to be connected to a new transport even if it was already connected to one. In a server environment where a single `McpServer` instance was reused for multiple clients, a new client connection would trigger this function and overwrite the transport of an existing client. This would cause responses intended for the original client to be lost or sent to the wrong client, leading to a data leak.

StreamableHTTPServerTransport.handleRequest

packages/sdk/src/http/streamableHttpServerTransport.ts

In stateless deployments, it was common to incorrectly reuse a single `StreamableHTTPServerTransport` instance for multiple incoming HTTP requests. The `handleRequest` function processes these requests. When two clients made requests concurrently to the same transport instance, their JSON-RPC message IDs could collide. This caused the internal mapping of message IDs to response streams to be overwritten, resulting in one client receiving responses intended for another. The vulnerability lies in the fact that this function was not safe for concurrent execution on the same instance in stateless mode.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.