Security readout for executives and security teams
Plain-English summary
A vulnerable MCP TypeScript SDK deployment can send one client’s response data to another client when server and transport instances are shared across connections. This is primarily a confidentiality issue for MCP services that process sensitive prompts, tool results, or business data. The source bundle says it is fixed in version 1.26.0.
Executive priority
Treat as a high-priority confidentiality fix for AI or automation services using MCP. Upgrade affected SDK versions quickly, then verify deployment patterns. Business urgency is highest where MCP traffic includes confidential customer, employee, security, or operational data.
Technical view
Versions 1.10.0 through 1.25.3 of modelcontextprotocol/typescript-sdk are affected. The flaw is a race/TOCTOU condition involving reused McpServer/Server and transport instances, especially stateless StreamableHTTPServerTransport deployments. CVSS is 7.1, network exploitable, low complexity, requiring low privileges, with high confidentiality and low integrity impact.
Likely exposure
Exposure is most likely in custom MCP servers using @modelcontextprotocol/sdk 1.10.0-1.25.3 and reusing one server or transport instance across multiple client connections. Deployments that create isolated instances per connection may not match the described vulnerable pattern.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. The CVSS vector indicates an authenticated network attacker with low privileges could trigger impact without user interaction. Evidence supports cross-client data leakage, not unauthenticated compromise or code execution.
Researcher notes
The vulnerability is implementation-pattern dependent: the affected SDK range alone is not enough to prove exposure. Focus review on shared mutable server/transport state and concurrent client handling. Sources identify CWE-362 and CWE-367, consistent with race and time-of-check/time-of-use behavior.
Mitigation direction
- Upgrade @modelcontextprotocol/sdk to version 1.26.0 or later.
- Review vendor advisory for any additional project-specific guidance.
- Avoid sharing one McpServer/Server instance across multiple client connections.
- Avoid reusing one transport instance across concurrent clients.
- Prioritize MCP services handling secrets, prompts, customer data, or tool outputs.
Validation and detection
- Inventory package manifests and lockfiles for @modelcontextprotocol/sdk versions below 1.26.0.
- Inspect MCP HTTP server code for shared McpServer, Server, or transport singletons.
- Identify stateless StreamableHTTPServerTransport deployments and review connection lifecycle handling.
- Confirm deployed artifacts resolve to @modelcontextprotocol/sdk 1.26.0 or later.
- Run regression tests covering concurrent client isolation without exposing sensitive production data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-367: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25536 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N2.84.2GitHub_MCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N2.84.2redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-02-04T22:00:54.864Z: Reported to Red Hat.
- 2026-02-04T21:29:38.276Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/modelcontextprotocol/typescript-sdk/issues/204CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/modelcontextprotocol/typescript-sdk/issues/243CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-25536CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2436937CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25536.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3960CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.