GitHub Advisory · Oct 3, 2026 · 3:15 PM

CVE-2026-104850: MCP TypeScript SDK OAuth could send credentials to a hostile server

GHSA-6qxp-vccf-f47h (CVE-2026-104850, CVSS 7.5) hits @modelcontextprotocol/sdk 1.12.0–1.30.1 and @modelcontextprotocol/client 2.0.0–2.1.0: a malicious MCP server could steer stored refresh tokens, client secrets, or bundled-provider assertions to an attacker-chosen authorization server with no user interaction. Upgrade to sdk 1.31.0 / client 2.2.0, pass expectedIssuer on M2M providers, and clear credentials saved without an issuer.

Read at github.com

More news

View all

Autograph ships a built-in MCP server for Claude and ChatGPT

Maxon's free Autograph 2027.0 includes an MCP server, off by default, that lets Claude Desktop, ChatGPT Desktop or a local model drive the app's own tools. Edits are ordinary project data and can be undone…

Renderu 57 minutes ago

Google Cloud's Organization Policy MCP server is now generally available

Announced Nov 14, the server lets agents audit policies, detect drift and manage exemptions across a Google Cloud org. Gemini can also draft and dry run custom constraints from plain English…

Brief AI 6 hours ago

Sitecore Developer MCP server enters beta

SitecoreAI's Developer MCP server is in beta with 13 tools for component development, content modeling and content creation. It connects to Cursor, Claude Code, Codex, VS Code and OpenCode via MCP OAuth…

Sitecore Docs 9 hours ago

Vaikora Guard MCP goes open source as a policy proxy for agent tool calls

Announced Nov 13, the MIT licensed proxy sits between an agent and its MCP tools and allows, blocks, modifies or pauses each call for approval. Every decision goes into a hash chained audit log, and it installs from PyPI as vaikora guard mcp…

Data443 21 hours ago

Darktrace MCP Server now generally available

Announced Nov 13, the server lets AI assistants query security alerts, pull Cyber AI Analyst findings, and run triage actions across licensed Darktrace products. A read only mode hides tools that change data…

Darktrace 22 hours ago

Spotted something we missed? Start a thread.