# @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Reusing one StreamableHTTPServerTransport or McpServer across clients causes JSON-RPC ID collisions, routing responses and notifications to the wrong client.

- Payout: Research
- Severity: high
- Program: Model Context Protocol SDK
- Found by: gh-arpeet, ahabian
- Disclosed: 2026-02-04
- CVE: CVE-2026-25536
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-345p-7cg4-v4c7
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-345p-7cg4-v4c7
- Tags: area:web domain:api impact:data-leak kind:research platform:ghsa sev:high tech:nodejs technique:race-window technique:source-review vuln:info-disclosure vuln:race-condition

**Target:** StreamableHTTPServerTransport / McpServer in @modelcontextprotocol/sdk
**Root cause:** Transport keeps a requestId→stream map keyed by client-generated incrementing JSON-RPC IDs; concurrent clients collide and overwrite entries. Separately, Protocol._transport is overwritten on each connect(), so in-request notifications/requests use the wrong client's transport.
**Steps:**
1. Deploy server in stateless mode reusing a single StreamableHTTPServerTransport (no sessionIdGenerator) or a single McpServer connected to multiple transports.
2. Two clients send concurrent requests; default SDK clients both start IDs at 0.
3. Second client's request overwrites the first's requestId→stream mapping entry.
4. First client's response (tools/call, resources/read, prompts/get) is written to the second client's HTTP stream.
5. For Issue 2, a tool sending sendNotification/sendRequest during execution dispatches via the overwritten this._transport to the wrong client.
**How found:** Analysts reasoned about the transport's internal requestId→stream mapping and the Protocol's single this._transport reference, noting SDK clients generate IDs from an incrementing counter starting at 0, so concurrent clients collide.
**Exploitation:** Attacker connects to a stateless MCP server that reuses transport/server instances and issues requests with low incrementing IDs concurrently with a victim; victim's tool results, progress notifications, sampling or elicitation requests are delivered to the attacker's stream.
**Insight:** When auditing MCP/JSON-RPC servers, check whether transport or server instances are shared across requests/sessions and whether request IDs are client-controlled and predictable; ID-keyed response routing plus shared state is a cross-client leak primitive.