VULNRABLE / Vulnerability / CVE-2026-111771
CVE-2026-111771
MEDIUM LOW @modelcontextprotocol/sdk GHSA
Exploit verdict: No active-exploit signal
CVSS Score
5.5
Severity
MEDIUM
EPSS
—
Source
GHSA
Summary
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
What this means
CVE-2026-111771 is a medium-severity vulnerability affecting @modelcontextprotocol/sdk, rated CVSS 5.5. Published October 20, 2026.
View full advisory at GHSA →