Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-01 · high
The bug lives in server code, not any single app, so builders who copied the SDK's default pattern pass the exposure to their own users.
Why now: This matters now because the shared-instance setup it flags is already common in production, not a rare misconfiguration.
CVE-2026-25536 hit the SDK when a single McpServer instance served multiple clients, per Practical DevSecOps. The bug scores 7.1 on CVSS and covers SDK versions 1.10.0 through 1.25.3.
Reusing one server instance across multiple clients isn't a fringe setup. It's already the default for shared and remote MCP deployments running in production.
That makes this a framework bug, not a downstream-app bug. Any MCP server built on that SDK range exposes its own users to a default its builder didn't choose. The users of that server pay for a decision they never made.
Upgrading past 1.25.3 stops the SDK's bug. It doesn't check whether your own server still assumes one instance per client somewhere else in the stack, so the audit is on you.
A CVSS score on a dependency says the library stopped being the guaranteed cause. It doesn't say a specific deployment stopped leaking. Patched isn't the same as safe.
Each link below shares sources, entities, or timing with this story.
Anthropic released MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover CVE, CVSS, MCP; overlapping topics (client, cvss, server).
Linked by a graph relationship (Anthropic released MCP); both cover MCP, MCPServer, SDK; overlapping topics (client, server).
Anthropic released MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover MCP, Practical DevSecOps, SDK; reported by the same outlet (practical-devsecops.com).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, CVSS, MCP; overlapping topics (audit, framework).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover CVE, CVSS, MCP; overlapping topics (cvss, server).
Cursor uses MCP / Shared entities / Same source / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover MCP, Practical DevSecOps; cite the same source (Practical DevSecOps).
Anthropic released MCP / Shared entities / Same source / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover CVE, MCP; cite the same source (Practical DevSecOps).
Anthropic released MCP / Shared entities / Earlier coverage / Tension
Linked by a graph relationship (Anthropic released MCP); both cover CVE, CVSS, MCP; earlier CVE coverage from 2026-03-23.