{"action":"Upgrade @modelcontextprotocol/sdk to 1.31.0 or later.","affected":[{"fixed":"1.31.0","introduced":"1.12.0"}],"component":"@modelcontextprotocol/sdk","cve_ids":["CVE-2026-104850"],"ecosystem":"npm","epss":0.00226,"exploited":false,"fixed_versions":["1.31.0"],"ghsa_id":"GHSA-6qxp-vccf-f47h","id":"tcs_01M5KF7SN4JBEW3PM2N93Y50GR","modified_at":"2026-10-06T15:46:47.143033168Z","published_at":"2026-10-06T15:35:44Z","references":["https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h","https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","https://github.com/modelcontextprotocol/typescript-sdk","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-6qxp-vccf-f47h","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h"}],"summary":"MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server"}