VDB
CVE-2026-111769
CVE-2026-111769
PUBLISHED
CVSS 6.5 MEDIUM
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | opensearch-dashboards-2 | 0 |
| modelcontextprotocol | sdk | 0 |
| chainguard | opensearch-dashboards-2-fips | 0 |
| chainguard | wazuh-dashboard | 0 |
| chainguard | kibana-9.3 | 0 |
| modelcontextprotocol | client | 2.0.0 |
| chainguard | kibana-9.2 | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
Timeline
- Oct 20, 2026 CVE Published
- Oct 30, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-111769 advisory
- https://github.com/advisories/GHSA-6prh-2h8m-c8cw advisory
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw url
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2901 patch
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2902 patch
- https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d patch
- https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0 patch