npm/@modelcontextprotocol/client CVE-2026-104850: high 7.5, EPSS 0.28%
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Action: Upgrade @modelcontextprotocol/client to 2.2.0 or later.
npm i @modelcontextprotocol/client@2.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.2.0 | - |
Fixed versions
| 2.2.0 |
Sources
- osv: GHSA-6qxp-vccf-f47h#npm/@modelcontextprotocol/client
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2887
- https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd
- https://github.com/modelcontextprotocol/typescript-sdk
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0
CVE-2026-104850 · published · modified · JSON