VULNRABLE / Vulnerability / CVE-2026-111769
CVE-2026-111769
MEDIUM LOW @modelcontextprotocol/sdk GHSA
Exploit verdict: No active-exploit signal
CVSS Score
5.5
Severity
MEDIUM
EPSS
—
Source
GHSA
Summary
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
What this means
CVE-2026-111769 is a medium-severity vulnerability affecting @modelcontextprotocol/sdk, rated CVSS 5.5. Published October 20, 2026.
View full advisory at GHSA →