Executive brief
The Model Context Protocol SDK contains a design flaw that allows responses and sensitive data from one client to leak to another client when the server improperly reuses connection objects across multiple simultaneous client connections. This is particularly problematic in stateless cloud deployments where the same server instance handles many clients. An attacker with multiple concurrent connections to the server could intercept another client's tool responses, resource data, prompts, or progress notifications intended for a different user.
Technical details
The vulnerability consists of two related issues: (1) Reusing a single StreamableHTTPServerTransport across multiple client requests causes JSON-RPC message ID collisions to route responses to the wrong HTTP stream, since the SDK's default client uses an incrementing counter starting at 0. (2) Reusing a single McpServer/Server instance across multiple transports causes the Protocol's internal _transport reference to be silently overwritten, routing final responses, progress notifications, and server-initiated requests to whichever client's transport was most recently connected. Both issues are most common in stateless mode without per-request or per-session server/transport instantiation. The vulnerability requires concurrent clients or in-flight requests; single-client environments are unaffected. The fix (v1.26.0) adds runtime guards to Protocol.connect() and StreamableHTTPServerTransport.handleRequest() that throw errors instead of silently misrouting data, forcing developers to use separate instances per connection.
Affected products
- Model Context Protocol @modelcontextprotocol/sdk >=1.10.0, <=1.25.3
Timeline
- 2026-02-04: disclosed
- 2026-02-04: patched: Fix released in version 1.26.0