What happened
Verified via advisory-derived coverage (secalerts/insightcve, Oct 20 publication): CVE-2026-111770 (CVSS 7.7) is a race/ownership flaw in MCP server response routing — messages matched by JSON-RPC id alone cause one client's responses and notifications to be delivered to another. The same advisory wave also included request-body memory exhaustion (CVE-2026-111768), bearer auth without audience check (CVE-2026-111771), experimental tasks not bound to a session (CVE-2026-111767, previously separately covered), and client transports following cross-origin redirects while forwarding refresh_token/client_secret (CVE-2026-111769).
Why it matters
MCP is the standard wiring between agents, tools and model gateways. A silent cross-client delivery bug in the official server SDK means one user's agent tool traffic (queries, tool outputs, potentially credentials) can land in another user's session on shared MCP gateways — a cross-tenant confidentiality break in the core agent protocol SDK.
Attack vector
Two clients with concurrent in-flight requests against a shared HTTP-mapped transport/server instance; the SDK matched messages to connections by JSON-RPC id alone, and SDK clients number requests from 0, so ids collide in normal use — no crafted ids required. Responses and notifications cross-deliver silently.
Affected systems
@modelcontextprotocol/server (MCP TypeScript server SDK) 2.0.0 – 2.2.0; fixed in 2.3.0 (also part of the Oct 20 MCP SDK advisory wave that fixed @modelcontextprotocol/sdk issues in 1.32.0)
Mitigation
Upgrade to @modelcontextprotocol/server 2.3.0+ AND refactor apps to create a fresh server per session (e.g. createMcpHandler() factory); after upgrade, shared-instance apps fail loudly with ALREADY_CONNECTED — which is the intended diagnostic. Advisory GHSA-jm63-cq47-j5jp; fix commit 84804c22e45a662675a198f853b7f00063838a8d.