Summary
A broken access control vulnerability in the MCP TypeScript SDK's experimental taskStore feature allows clients sharing an in-memory task store to access tasks created by other sessions.
When multiple sessions use the same store, an unauthorized client may list, read, or cancel another session's tasks.
A broken access control vulnerability in the MCP TypeScript SDK's experimental taskStore feature allows clients sharing an in-memory task store to access tasks created by other sessions.
When multiple sessions use the same store, an unauthorized client may list, read, or cancel another session's tasks.
Affected context
The issue occurs in MCP TypeScript SDK releases that include the experimental tasks feature and use a shared InMemoryTaskStore. The task store did not sufficiently associate tasks with the session that created them, so isolation between clients could be lost when several sessions operated against the same store.
The issue occurs in MCP TypeScript SDK releases that include the experimental tasks feature and use a shared InMemoryTaskStore. The task store did not sufficiently associate tasks with the session that created them, so isolation between clients could be lost when several sessions operated against the same store.
Exploit preconditions
- Attack surface: MCP task management operations exposed through a server or client integration
- Required access: Access to an MCP session that can interact with the shared task store
- Trigger point: Task listing, reading, or cancellation operations
- Why exploitation is possible: Task ownership was not checked against the requesting session, allowing cross-session access to task records
- Attack surface: MCP task management operations exposed through a server or client integration
- Required access: Access to an MCP session that can interact with the shared task store
- Trigger point: Task listing, reading, or cancellation operations
- Why exploitation is possible: Task ownership was not checked against the requesting session, allowing cross-session access to task records
Why this happens
The underlying bug is a missing authorization check in task lifecycle operations. The implementation trusted task-store access without verifying that the requesting session was the session that created or owned the task.
This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key, because an accessible task identifier or task record could be used without an adequate ownership check. It also relates to CWE-862: Missing Authorization, since the required session-level authorization decision was absent.
The underlying bug is a missing authorization check in task lifecycle operations. The implementation trusted task-store access without verifying that the requesting session was the session that created or owned the task.
This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key, because an accessible task identifier or task record could be used without an adequate ownership check. It also relates to CWE-862: Missing Authorization, since the required session-level authorization decision was absent.
Potential impact
- An unauthorized client may view task metadata or results
- A client could cancel tasks belonging to another session
- Cross-session information disclosure may occur
- Applications could experience workflow disruption or denial of expected task processing
- Sensitive task content may be exposed where task results contain confidential data
- An unauthorized client may view task metadata or results
- A client could cancel tasks belonging to another session
- Cross-session information disclosure may occur
- Applications could experience workflow disruption or denial of expected task processing
- Sensitive task content may be exposed where task results contain confidential data
General mitigation guidance
Mitigation generally focuses on enforcing ownership and authorization at every task operation.
Defensive patterns include:
- Associate each task with an unforgeable creator-session or tenant identity
- Verify ownership or explicit authorization before listing, reading, updating, or cancelling tasks
- Prefer isolated task stores for sessions or tenants when shared state is unnecessary
- Avoid treating client-supplied task identifiers as proof of authorization
- Apply least-privilege access to task-management capabilities
- Clear or expire task records according to a defined lifecycle policy
Mitigation generally focuses on enforcing ownership and authorization at every task operation.
Defensive patterns include:
- Associate each task with an unforgeable creator-session or tenant identity
- Verify ownership or explicit authorization before listing, reading, updating, or cancelling tasks
- Prefer isolated task stores for sessions or tenants when shared state is unnecessary
- Avoid treating client-supplied task identifiers as proof of authorization
- Apply least-privilege access to task-management capabilities
- Clear or expire task records according to a defined lifecycle policy
How teams detect issues like this
Organizations can assess for this class of issue through:
- Static analysis and code review searches for task lookups that lack adjacent ownership checks
- Tests using multiple sessions against the same task store
- Authorization matrix tests covering list, read, and cancel operations
- Policy checks requiring resource-owner validation for identifiers supplied by clients
- Runtime audit logging that records task access, session identity, and authorization decisions
Automated security testing and code-review tools may help identify resource-access paths that do not enforce session or tenant boundaries.
Organizations can assess for this class of issue through:
- Static analysis and code review searches for task lookups that lack adjacent ownership checks
- Tests using multiple sessions against the same task store
- Authorization matrix tests covering list, read, and cancel operations
- Policy checks requiring resource-owner validation for identifiers supplied by clients
- Runtime audit logging that records task access, session identity, and authorization decisions
Automated security testing and code-review tools may help identify resource-access paths that do not enforce session or tenant boundaries.
