Cloudanix VulnDB

GHSA-345p-7cg4-v4c7

High · 7.1

CVSS

7.1

EPSS

—

Published

Feb 4, 2026

CISA due date

—

The record

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Affected packages

Ecosystem Package Introduced Fixed
npm @modelcontextprotocol/sdk 1.10.0 1.26.0
Chainguard kibana-9.1 0 9.1.10-r4
Chainguard kibana-9.1-iamguarded 0 9.1.10-r4
Chainguard kibana-9.2 0 9.2.5-r0
Chainguard kibana-9.2-iamguarded 0 9.2.5-r0
Chainguard langfuse-3 0 3.153.0-r0
Chainguard langfuse-3-worker 0 3.153.0-r0
Chainguard langfuse-fips-3 0 3.152.0-r0
Chainguard langfuse-fips-3-worker 0 3.152.0-r0
Chainguard librechat 0 0.8.2-r2
Chainguard opensearch-dashboards-2 0 2.19.4-r8
Chainguard opensearch-dashboards-2-fips 0 2.19.4-r9
Wolfi langfuse-3 0 3.153.0-r0
Wolfi langfuse-3-worker 0 3.153.0-r0
Wolfi opensearch-dashboards-2 0 2.19.4-r8

Related vulnerabilities