Advisory CVE-2026-111770 (CVSS 7.7, published October 20, 2026) affects @modelcontextprotocol/server versions 2.0.0 to 2.2.x: an HTTP MCP server that shares one transport across clients can hand one client's responses and notifications to another. The cause is an identifier collision.
How the Flaw Works
The MCP protocol uses JSON-RPC messages, where each request carries an id so the response can be matched to it. According to the advisory, when an HTTP-exposed server reuses a single stateless transport, or the same McpServer or Server instance, for multiple clients, messages were tied to a connection "solely by the JSON-RPC id". Because the SDK's clients number their requests starting at 0, IDs collide as a matter of course: client A and client B both send id 0, and the response can end up with the wrong one.
Why It's Not Just Another Bug
An MCP server typically returns tool data: database queries, files, tickets. If responses cross between clients, one user or agent can receive data from another session, with no need for an attacker to "break" anything: sharing the same instance is enough. The score (high confidentiality, low integrity, high availability, high attack complexity) reflects that it depends on the race condition and on the deployment pattern.
How to Mitigate It
- Update to
@modelcontextprotocol/server2.3.0 or later; the advisory lists no other workaround. - Create one server instance and transport per client session instead of reusing a global one.
- Review your own MCP servers exposed over HTTP, especially in stateless mode.
- Log session IDs and compare responses in tests with two concurrent clients.
Sources: GitLab Advisory Database and Vulert (CVE-2026-111770, October 20, 2026).