CVE-2026-111769 | Vulnetix

CVE-2026-111769 PUBLISHED CVSS 6.5 MEDIUM

Record from CVE.org · Published October 20, 2026

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
@modelcontextprotocol/sdk	npm	1.32.0
@modelcontextprotocol/client	npm	2.3.0
opensearch-dashboards-2	Chainguard	2.19.6-r31
commercial-gitlab-rails-ee-fips-19.1	Chainguard	19.1.9-r0
opensearch-dashboards-2-fips	Chainguard	2.19.6-r17
wazuh-dashboard	Chainguard	4.14.9-r4
kibana-9.3	Chainguard	9.3.8-r7
kibana-9.2	Chainguard	9.2.8-r27
wazuh-dashboard-fips	Chainguard	4.14.9-r3

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Vendor	Product	Versions
chainguard	opensearch-dashboards-2	0
chainguard	commercial-gitlab-rails-ee-fips-19.1	0
modelcontextprotocol	sdk	0
chainguard	opensearch-dashboards-2-fips	0
chainguard	wazuh-dashboard	0
chainguard	kibana-9.3	0
modelcontextprotocol	client	2.0.0
chainguard	kibana-9.2	0
chainguard	wazuh-dashboard-fips	0

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-111769
vulnetix vdb fixes CVE-2026-111769

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-111769/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart