{ "schema_version": "0.4", "id": "REG-0028", "title": "Model Context Protocol (MCP) TypeScript software development kit (SDK): a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, patched 28 September 2026", "batch": "agent-2026-10-13", "family": "software", "context": { "domain": "Software agent (Model Context Protocol client SDK, OAuth over HTTP)", "autonomy_level": "alone", "autonomy_level_text": "The client sends credentials to the authorization server the MCP server names, with no user interaction", "actor_type": "Software: an MCP client over HTTP using the OAuth client of @modelcontextprotocol/sdk 1.12.0 to 1.30.1, or of @modelcontextprotocol/client 2.0.0 to 2.1.0 in specific setups (bundled providers without expectedIssuer, credentials stored or supplied without an issuer, direct fetchToken() calls)", "actors": { "count": 1, "text": "1 MCP client; attacker as a malicious or compromised MCP server", "roles": [ "defender" ] }, "mandate_context": "demonstration", "mandate_context_text": "Vulnerability disclosure; no exploitation reported", "jurisdiction": [ "Global (open-source SDK)" ] }, "actor_status": "confirmed", "provenance_tier": "disclosure_corroborated", "provenance_tier_text": "Maintainer advisory published through the GitHub CNA and recorded in NVD, mirrored with fix commit and releases in the GitLab advisory database", "status": "confirmed", "status_text": "Confirmed (patched; some setups need changes beyond upgrading; no exploitation reported)", "outcome": { "state": "averted_by_disclosure", "severity": "none reported; the maintainers' advisory rates the flaw High, with a CVSS (Common Vulnerability Scoring System, a severity score) version 3.1 base score of 7.5, published by GitHub as the CVE numbering authority; the National Vulnerability Database had not done its own analysis as of 21 October 2026", "affected_parties": [], "cost": "none reported", "regime_consequence": "none", "as_of": "Oct 2026", "derived_by": "agent" }, "fields": [ { "layer": "Mandate", "facet": "principal", "value": "The owner of an application that uses the SDK as an MCP client over HTTP with an authProvider and holds credentials for a legitimate authorization server", "assertion_type": "fact", "source_ids": [ "NVD-104850" ], "confidence": "high", "disputed": false }, { "layer": "Mandate", "facet": "objective", "value": "not evidenced in source", "assertion_type": "assertion", "source_ids": [ "NVD-104850" ], "confidence": "low", "disputed": false }, { "layer": "Actor", "facet": null, "value": "The SDK's OAuth client support in an MCP client, holding a stored refresh_token and client_secret (1.x) or the configured client_secret or signed assertion of a bundled non-interactive provider (1.x and 2.x)", "assertion_type": "fact", "source_ids": [ "NVD-104850" ], "confidence": "high", "disputed": false }, { "layer": "Inputs", "facet": null, "value": "Protected resource metadata from the MCP server the client connected to, naming the authorization server; a malicious or compromised MCP server could name its own", "assertion_type": "fact", "source_ids": [ "NVD-104850" ], "confidence": "high", "disputed": false }, { "layer": "Decision", "facet": null, "value": "The client let the MCP server decide which authorization server received its OAuth credentials, without any user interaction", "assertion_type": "fact", "source_ids": [ "NVD-104850", "GLAD" ], "confidence": "high", "disputed": false }, { "layer": "Envelope", "facet": "authority", "value": "Stored and pre-provisioned credentials were not bound to the authorization server they belong to", "assertion_type": "fact", "source_ids": [ "NVD-104850" ], "confidence": "high", "disputed": false }, { "layer": "Action", "facet": null, "value": "The client sends the refresh_token and client_secret stored from an earlier sign-in (1.x), or the configured client_secret or signed assertion of a bundled non-interactive provider (1.x and 2.x), to the authorization server the MCP server named", "assertion_type": "fact", "source_ids": [ "NVD-104850" ], "confidence": "high", "disputed": false }, { "layer": "Outcome", "facet": null, "value": "State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026.", "assertion_type": "assertion", "source_ids": [ "NVD-104850", "GLAD" ], "confidence": "medium", "disputed": false }, { "layer": "Evidence", "facet": "event", "value": "Maintainers' repository advisory GHSA-6qxp-vccf-f47h, published 30 September 2026 and crediting three reporters; GitHub advisory database entry, CVE-2026-104850 record and National Vulnerability Database listing dated 6 October 2026; CVSS (a severity score) version 3.1 base 7.5, High, supplied by GitHub; weaknesses CWE-345 (insufficient verification of data authenticity) and CWE-522 (insufficiently protected credentials)", "assertion_type": "fact", "source_ids": [ "GHSA", "NVD-104850", "GLAD" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "technical", "value": "Patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0 (and @modelcontextprotocol/core 2.2.0 if imported directly), released 28 September 2026: the client records the authorization server as issuer on saved credentials and does not send them to a different one. Upgrading is not enough for bundled providers (pass expectedIssuer), credentials saved without an issuer (add it or clear them) or custom OAuthClientProvider implementations (persist issuer). Not covered: a new interactive sign-in, direct refreshAuthorization() and exchangeAuthorization() calls, and 2.x with skipIssuerMetadataValidation: true. The advisory says to rotate the client secret or signing key and revoke tokens if an affected client may have connected to an untrusted MCP server. Workarounds: 2.0.0 and 2.1.0 already accept expectedIssuer; on 1.x, connect OAuth-enabled clients only to trusted MCP servers", "assertion_type": "fact", "source_ids": [ "GHSA", "NVD-104850", "FIX-1X", "REL-220" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "accountability", "value": "Coordinated disclosure through the maintainers' security advisory, which credits three reporters; the patched releases (28 September 2026) came out two days before the advisory was published (30 September 2026)", "assertion_type": "fact", "source_ids": [ "GHSA", "FIX-1X", "REL-220" ], "confidence": "high", "disputed": false } ], "inference": { "value": "The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and none of its sources includes a demonstration of an attack.", "source_ids": [ "GHSA", "NVD-104850" ], "confidence": "medium", "signed_by": "Saurabh Bhatnagar", "signed_on": "2026-10-21" }, "controls": { "failed": [ { "id": "C-A2", "note": "Stored credentials were not bound to the authorization server they belong to", "confidence": "high", "basis": "agent" }, { "id": "C-A1", "note": "The client did not verify that the authorization server named in server-supplied metadata was the one the credentials belonged to", "confidence": "medium", "basis": "agent" } ], "succeeded": [ { "id": "C-O1", "note": "Coordinated disclosure and fix", "confidence": "high", "basis": "agent" } ], "absent": [] }, "applicable_rules": [ "None applicable; maintainer security policy" ], "unmapped": [], "named_parties": [ { "name": "Model Context Protocol TypeScript SDK maintainers", "right_of_reply": { "offered": "2026-10-22", "response": null, "channel": "GitHub private vulnerability report GHSA-2295-fw8x-gm4r on modelcontextprotocol/typescript-sdk (visible to the maintainers only)" } } ], "sources": { "NVD-104850": { "title": "National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis", "type": "standards_body", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104850", "date": "2026-10-06", "tier": "disclosure_corroborated", "interest": null }, "GLAD": { "title": "GitLab advisory database entry for @modelcontextprotocol/sdk CVE-2026-104850, citing GHSA-6qxp-vccf-f47h, fix commit edd12e2, pull request 2887 and release v2.2.0", "type": "public_record", "url": "https://advisories.gitlab.com/npm/@modelcontextprotocol/sdk/CVE-2026-104850/", "date": "2026-10-06", "tier": "disclosure_corroborated", "interest": null }, "GHSA": { "title": "modelcontextprotocol/typescript-sdk repository security advisory GHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (published by maintainer maxisbey on 30 September 2026, crediting three reporters; full text read as mirrored at api.osv.dev/v1/vulns/GHSA-6qxp-vccf-f47h and in the GitHub advisory database, entry dated 6 October 2026)", "type": "company", "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h", "date": "2026-09-30", "tier": "disclosure_corroborated", "interest": "maintainers describing their own software", "primary": true, "checked": "2026-10-21", "via_press": false }, "FIX-1X": { "title": "modelcontextprotocol/typescript-sdk on GitHub: commit 51ad4f0, '[v1.x] Bind stored OAuth credentials to the authorization server that issued them (#2888)', 28 September 2026; released as @modelcontextprotocol/sdk 1.31.0, published to npm on 28 September 2026", "type": "company", "url": "https://github.com/modelcontextprotocol/typescript-sdk/commit/51ad4f03190dc5c84ab8b1a25f9b78b277be0dc7", "date": "2026-09-28", "tier": "disclosure_corroborated", "interest": "maintainers' own repository", "primary": true, "checked": "2026-10-21", "via_press": false }, "REL-220": { "title": "Release 2.2.0 · modelcontextprotocol/typescript-sdk (tag v2.2.0, 28 September 2026; @modelcontextprotocol/client 2.2.0 published to npm the same day)", "type": "company", "url": "https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0", "date": "2026-09-28", "tier": "disclosure_corroborated", "interest": "maintainers' own repository", "primary": true, "checked": "2026-10-21", "via_press": false } }, "corrections": [ { "date": "2026-10-13", "field": "controls.C-I1", "old": "failed: Retrieved content as data (server-supplied metadata decided where credentials were sent)", "new": "failed: Actor identity verification (the client did not verify the authorization server named in the metadata)", "reason": "the failure is trusting an unverified issuer, not following instructions in retrieved text; now matches the signal's mapping" }, { "date": "2026-10-14", "field": "reviewed_by", "old": "none", "new": "Saurabh Bhatnagar (editor)", "reason": "case checked by the editor against its linked records" }, { "date": "2026-10-21", "field": "title", "old": "MCP TypeScript SDK: a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, fixed October 2026", "new": "Model Context Protocol (MCP) TypeScript software development kit (SDK): a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, patched 28 September 2026", "reason": "Found in the editor's source check of 21 October 2026: the patched releases were published on 28 September 2026 (commit 51ad4f0 released as @modelcontextprotocol/sdk 1.31.0, and release v2.2.0 of @modelcontextprotocol/client, both published to npm that day; sources FIX-1X and REL-220), before the advisory (30 September 2026 in the repository, 6 October 2026 in the GitHub advisory database, the CVE record and the National Vulnerability Database), so 'fixed October 2026' was wrong; 'patched' replaces 'fixed' because the maintainers' advisory (GHSA) lists cases the fix does not cover; abbreviations spelled out" }, { "date": "2026-10-21", "field": "context.actor_type", "old": "Software: an MCP client built on @modelcontextprotocol/sdk 1.x or @modelcontextprotocol/client 2.x with an authProvider", "new": "Software: an MCP client over HTTP using the OAuth client of @modelcontextprotocol/sdk 1.12.0 to 1.30.1, or of @modelcontextprotocol/client 2.0.0 to 2.1.0 in specific setups (bundled providers without expectedIssuer, credentials stored or supplied without an issuer, direct fetchToken() calls)", "reason": "Found in the editor's source check of 21 October 2026: the maintainers' advisory (GHSA) and the CVE record (NVD-104850) give the affected ranges as @modelcontextprotocol/sdk 1.12.0 through 1.30.1 and @modelcontextprotocol/client 2.0.0 through 2.1.0, the latter 'only for' bundled providers without expectedIssuer, credentials stored or supplied without issuer, direct calls to fetchToken() and providers that read storage back through the schemas; 'any 1.x or 2.x' overstated the affected set" }, { "date": "2026-10-21", "field": "outcome.severity", "old": "none reported (CVSS 3.1 base 7.5)", "new": "none reported; the maintainers' advisory rates the flaw High, with a CVSS (Common Vulnerability Scoring System, a severity score) version 3.1 base score of 7.5, published by GitHub as the CVE numbering authority; the National Vulnerability Database had not done its own analysis as of 21 October 2026", "reason": "Found in the editor's source check of 21 October 2026: the 7.5 score comes from GitHub, the CVE numbering authority, and the maintainers' advisory (GHSA); the National Vulnerability Database record (NVD-104850) lists it as a 'Secondary' score from security-advisories@github.com and still shows status 'Awaiting Analysis' when read on 21 October 2026; the case did not say who assigned the score or spell out CVSS" }, { "date": "2026-10-21", "field": "outcome.regime_consequence", "old": "CVE-2026-104850 (GHSA-6qxp-vccf-f47h); fixed in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0", "new": "CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need configuration changes", "reason": "Found in the editor's source check of 21 October 2026: release dates from the maintainers' repository and npm (FIX-1X, REL-220); the maintainers' advisory (GHSA) says 'upgrading to the patched version is not enough' for bundled providers, credentials saved without issuer and custom OAuthClientProvider implementations" }, { "date": "2026-10-21", "field": "fields.Evidence event", "old": "{\"value\": \"Maintainer advisory GHSA-6qxp-vccf-f47h; NVD record CVE-2026-104850 published 6 October 2026; CVSS 3.1 base 7.5; weaknesses CWE-345 and CWE-522\", \"source_ids\": [\"NVD-104850\", \"GLAD\"]}", "new": "{\"value\": \"Maintainers' repository advisory GHSA-6qxp-vccf-f47h, published 30 September 2026 and crediting three reporters; GitHub advisory database entry, CVE-2026-104850 record and National Vulnerability Database listing dated 6 October 2026; CVSS (a severity score) version 3.1 base 7.5, High, supplied by GitHub; weaknesses CWE-345 (insufficient verification of data authenticity) and CWE-522 (insufficiently protected credentials)\", \"source_ids\": [\"GHSA\", \"NVD-104850\", \"GLAD\"]}", "reason": "Found in the editor's source check of 21 October 2026: the repository advisory page (GHSA) shows 'maxisbey published GHSA-6qxp-vccf-f47h Sep 30, 2026' and credits three reporters; 6 October 2026 is the date of the GitHub advisory database entry, the CVE record and the NVD listing (NVD-104850), where the 7.5 score is GitHub's and NVD has not analysed the record; abbreviations spelled out" }, { "date": "2026-10-21", "field": "fields.Recovery technical", "old": "{\"value\": \"Fixed in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0; 2.0.0 and 2.1.0 already accept expectedIssuer; on 1.x the only workaround is to connect OAuth-enabled clients only to trusted MCP servers\", \"source_ids\": [\"NVD-104850\"]}", "new": "{\"value\": \"Patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0 (and @modelcontextprotocol/core 2.2.0 if imported directly), released 28 September 2026: the client records the authorization server as issuer on saved credentials and does not send them to a different one. Upgrading is not enough for bundled providers (pass expectedIssuer), credentials saved without an issuer (add it or clear them) or custom OAuthClientProvider implementations (persist issuer). Not covered: a new interactive sign-in, direct refreshAuthorization() and exchangeAuthorization() calls, and 2.x with skipIssuerMetadataValidation: true. The advisory says to rotate the client secret or signing key and revoke tokens if an affected client may have connected to an untrusted MCP server. Workarounds: 2.0.0 and 2.1.0 already accept expectedIssuer; on 1.x, connect OAuth-enabled clients only to trusted MCP servers\", \"source_ids\": [\"GHSA\", \"NVD-104850\", \"FIX-1X\", \"REL-220\"]}", "reason": "Found in the editor's source check of 21 October 2026: the maintainers' advisory (GHSA) says upgrading is not enough in three setups, lists three cases 'Not covered by this fix', and advises rotating secrets and revoking tokens; the field said only 'Fixed'; release date from FIX-1X and REL-220" }, { "date": "2026-10-21", "field": "fields.Recovery accountability", "old": "{\"value\": \"Coordinated disclosure through the maintainer's security advisory\", \"source_ids\": [\"NVD-104850\", \"GLAD\"]}", "new": "{\"value\": \"Coordinated disclosure through the maintainers' security advisory, which credits three reporters; the patched releases (28 September 2026) came out two days before the advisory was published (30 September 2026)\", \"source_ids\": [\"GHSA\", \"FIX-1X\", \"REL-220\"]}", "reason": "Found in the editor's source check of 21 October 2026: the cited NVD and GitLab records carry no reporter credits or disclosure history; the repository advisory (GHSA) credits three reporters and was published 30 September 2026, after the 28 September releases (FIX-1X, REL-220)" }, { "date": "2026-10-21", "field": "inference.value", "old": "{\"value\": \"A credential has to be bound to where it may be presented; if the party asking for it can also name where it goes, the client will hand it to whoever asks.\", \"source_ids\": [\"NVD-104850\"]}", "new": "{\"value\": \"The record shows that the SDK's OAuth client did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.\", \"source_ids\": [\"GHSA\", \"NVD-104850\"]}", "reason": "Found in the editor's source check of 21 October 2026: the earlier wording stated a general rule the sources do not state and said the client 'will hand it to whoever asks', beyond the affected set the maintainers' advisory (GHSA) defines; it also did not say what the record does not show (no exploitation, per the CISA enrichment in the CVE record; no public proof of concept; a patch with stated limits). The interpretation was unsigned, so no signature was cleared" }, { "date": "2026-10-21", "field": "sources.NVD-104850.title", "old": "NVD record CVE-2026-104850 (CNA: GitHub), text of maintainer advisory, CVSS 3.1 7.5", "new": "National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis", "reason": "Found in the editor's source check of 21 October 2026: the NVD record carries GitHub's CVE description, a shorter text than the maintainers' advisory that omits its 'not enough' and 'not covered' sections, so 'text of maintainer advisory' was inaccurate; the record's own title added and its status recorded (read through the NVD application programming interface, as the web page renders by script)" }, { "date": "2026-10-21", "field": "sources.GHSA", "old": null, "new": "modelcontextprotocol/typescript-sdk repository security advisory GHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (published by maintainer maxisbey on 30 September 2026, crediting three reporters; full text read as mirrored at api.osv.dev/v1/vulns/GHSA-6qxp-vccf-f47h and in the GitHub advisory database, entry dated 6 October 2026)", "reason": "Found in the editor's source check of 21 October 2026: new primary source read in this check (https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h)" }, { "date": "2026-10-21", "field": "sources.FIX-1X", "old": null, "new": "modelcontextprotocol/typescript-sdk on GitHub: commit 51ad4f0, '[v1.x] Bind stored OAuth credentials to the authorization server that issued them (#2888)', 28 September 2026; released as @modelcontextprotocol/sdk 1.31.0, published to npm on 28 September 2026", "reason": "Found in the editor's source check of 21 October 2026: new primary source read in this check (https://github.com/modelcontextprotocol/typescript-sdk/commit/51ad4f03190dc5c84ab8b1a25f9b78b277be0dc7)" }, { "date": "2026-10-21", "field": "sources.REL-220", "old": null, "new": "Release 2.2.0 · modelcontextprotocol/typescript-sdk (tag v2.2.0, 28 September 2026; @modelcontextprotocol/client 2.2.0 published to npm the same day)", "reason": "Found in the editor's source check of 21 October 2026: new primary source read in this check (https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0)" }, { "date": "2026-10-21", "field": "inference.value", "old": "The record shows that the SDK's OAuth client did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.", "new": "The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: abbreviations spelled out (SDK, MCP), as in the case title." }, { "date": "2026-10-21", "field": "inference.value", "old": "The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.", "new": "The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: two of the advisory's three setups need a stored-data or code change, not configuration: 'upgrading to the patched version is not enough. You also need to make a change' (GHSA-6qxp-vccf-f47h)." }, { "date": "2026-10-21", "field": "inference.value", "old": "The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.", "new": "The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and none of its sources includes a demonstration of an attack.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: a vulnerability-tracking site (TheHackerWire) lists a public proof-of-concept repository for this flaw that the check could not open, so the statement is limited to the case's sources." }, { "date": "2026-10-21", "field": "outcome.regime_consequence", "old": "CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need configuration changes", "new": "CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need changes beyond upgrading", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: third check: matches the corrected interpretation; the advisory says 'upgrading to the patched version is not enough. You also need to make a change' (GHSA-6qxp-vccf-f47h)." }, { "date": "2026-10-21", "field": "status_text", "old": "Confirmed (fixed; no exploitation reported)", "new": "Confirmed (patched; some setups need changes beyond upgrading; no exploitation reported)", "reason": "Editor's call H4 of 21 October 2026 (accepted as amended, pull request #79): the advisory says upgrading alone is not enough in some setups ('You also need to make a change', GHSA-6qxp-vccf-f47h)." }, { "date": "2026-10-22", "field": "outcome.regime_consequence", "old": "CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need changes beyond upgrading", "new": "none", "reason": "Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a CVE, an advisory, a score or a fix is not one. The CVE and fix details are already in the Evidence and Recovery fields, so nothing is lost. Found while drafting this case's letters, 22 October 2026." }, { "date": "2026-10-22", "field": "named_parties[Model Context Protocol TypeScript SDK maintainers].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-22\", \"response\": null}", "reason": "right of reply recorded by a human" } ], "created": "2026-10-13", "last_reviewed": "2026-10-22", "reviewed_by": "Saurabh Bhatnagar (editor)", "derived_by": "agent" }