CVE-2026-25536: MCP TypeScript SDK Data Leak Vulnerability

CVE-2026-25536 Overview

A race condition vulnerability has been identified in the MCP TypeScript SDK, the official TypeScript SDK for Model Context Protocol servers and clients. This vulnerability enables cross-client response data leakage when a single McpServer/Server and transport instance is reused across multiple client connections. The issue is most prevalent in stateless StreamableHTTPServerTransport deployments where shared resources between concurrent connections can lead to sensitive data being exposed to unintended recipients.

Critical Impact

Sensitive response data intended for one client may be leaked to other connected clients due to improper isolation of server state, potentially exposing confidential information across client boundaries.

Affected Products

• MCP TypeScript SDK versions 1.10.0 through 1.25.3
• Applications using StreamableHTTPServerTransport with shared server instances
• Model Context Protocol server deployments with multiple concurrent client connections

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-25536 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25536

Vulnerability Analysis

This vulnerability stems from CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), commonly known as a race condition. When deploying MCP TypeScript SDK in environments where a single server instance handles multiple client connections simultaneously, response data can inadvertently be routed to the wrong client due to improper isolation of client-specific state.

The flaw is particularly dangerous in stateless HTTP transport scenarios where the StreamableHTTPServerTransport class is instantiated once and reused across all incoming client requests. Without proper synchronization mechanisms, response callbacks may reference stale or incorrect client context, resulting in data leakage between sessions.

The network-accessible nature of this vulnerability means attackers can potentially exploit it remotely without special privileges beyond basic authentication to the MCP server. The primary impact is confidentiality loss, as sensitive AI model responses, context data, or user-specific information may be exposed to unauthorized parties.

Root Cause

The root cause is a race condition in the shared server and transport instance architecture. When multiple clients connect to the same McpServer or Server instance, response handlers may not properly maintain client isolation. The StreamableHTTPServerTransport was designed for stateless operation but failed to properly segregate response delivery channels between concurrent client sessions. This allows response data generated for one client to potentially be delivered to another client's connection.

Attack Vector

An attacker can exploit this vulnerability by establishing multiple concurrent connections to a vulnerable MCP server deployment. By timing requests appropriately and monitoring responses, an attacker may receive response data intended for other clients. This is particularly concerning in multi-tenant environments where the MCP server processes requests from multiple users or applications.

The attack requires network access to the MCP server and low-privilege authentication (if required by the deployment). No user interaction is necessary, and the attacker can passively receive leaked data during normal server operation. The vulnerability is most easily exploited in high-concurrency scenarios where race conditions are more likely to manifest.

Detection Methods for CVE-2026-25536

Indicators of Compromise

• Unexpected response data appearing in client connections that doesn't match the original request context
• Log entries showing response delivery to mismatched client session identifiers
• Users reporting receipt of data belonging to other users or sessions
• Anomalous patterns in response timing that suggest race condition exploitation

Detection Strategies

• Monitor MCP server logs for response routing inconsistencies or session ID mismatches
• Implement response validation on clients to detect when received data doesn't match request context
• Audit deployments for shared McpServer or StreamableHTTPServerTransport instances across client connections
• Review application architecture to identify stateless HTTP transport deployments with concurrent access patterns

Monitoring Recommendations

• Enable detailed logging for all MCP server response routing operations
• Implement alerting for any detected cross-session data routing anomalies
• Monitor connection patterns for suspicious concurrent connection attempts
• Track version deployment to ensure vulnerable SDK versions (1.10.0 to 1.25.3) are identified for remediation

How to Mitigate CVE-2026-25536

Immediate Actions Required

• Upgrade MCP TypeScript SDK to version 1.26.0 or later immediately
• Audit all deployments using StreamableHTTPServerTransport for shared instance patterns
• Consider implementing per-client server instances as a temporary mitigation until patching is complete
• Review logs for any historical evidence of cross-client data leakage

Patch Information

The vulnerability has been patched in MCP TypeScript SDK version 1.26.0. Organizations should update their dependencies immediately. For npm-based projects, run npm update @modelcontextprotocol/sdk or explicitly set the version to 1.26.0 or later in your package.json.

Additional technical details and discussion can be found in the GitHub Security Advisory GHSA-345p-7cg4-v4c7. Related issues are documented in GitHub Issue #204 and GitHub Issue #243.

Workarounds

• Deploy separate McpServer instances per client connection rather than reusing a single shared instance
• Implement request-response correlation validation at the application layer to detect and reject misrouted responses
• Add connection isolation middleware to ensure each client request is handled in an isolated context
• Consider switching to stateful transport mechanisms until the patch can be applied

# Configuration example
# Update MCP TypeScript SDK to patched version
npm install @modelcontextprotocol/sdk@1.26.0

# Verify installed version
npm list @modelcontextprotocol/sdk

# For yarn users
yarn upgrade @modelcontextprotocol/sdk@1.26.0