The official MCP TypeScript SDK leaked data across clients for a year

CVE-2026-25536 hit the official MCP TypeScript SDK, versions 1.10.0 through 1.25.3, CVSS 7.1. The bug: if you reuse a single McpServer instance to serve multiple clients, which is a normal pattern for shared or remote MCP deployments, data leaks across those clients. One client's context bleeds into another's.

This isn't a bug in someone's MCP integration. It's in the SDK itself, the thing builders are told to trust by default. If you wrote an MCP server on that version range and you're reusing server instances instead of spinning up a fresh one per client, you've probably got a leak.

I've been watching the MCP security reports pile up this year and the pattern is consistent. It's not one bad actor's tool. It's the plumbing. Two CVSS-9.8 RCE bugs showed up in MCPJam Inspector and nginx-ui. A CVSS-10.0 flaw in mcp-pinot exposed unauthenticated tool invocation because OAuth was off by default. Now the SDK itself. NSA and CISA even put out MCP-specific security design guidance this year, which tells you the protocol grew faster than its safety rails.

What to actually do

If you're running MCP servers on the SDK in that version range, upgrade first. Then go look at how your server handles multiple clients. Don't assume instance reuse is safe just because nothing's broken yet. Silent data leaks don't throw errors, they just quietly hand one user's context to another.

I'd treat this the same way I treat any dependency that touches auth or session boundaries: read the changelog on every MCP SDK bump, not just the ones that mention security. This one didn't announce itself loudly. That's exactly the kind of bug that sits in production for a year.