{"schema":"vulnpedia.research/1","cve":"CVE-2026-104850","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h","tags":["x_refsource_CONFIRM","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"},{"source":"nvd","sourceId":"CVE-2026-104850","modified":"2026-10-06T20:03:40.690","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"}]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887"},{"source":"nvd","sourceId":"CVE-2026-104850","modified":"2026-10-06T20:03:40.690","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887"},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2887"}]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd"},{"source":"nvd","sourceId":"CVE-2026-104850","modified":"2026-10-06T20:03:40.690","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd"},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd"}]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T16:08:21.514Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"},{"source":"nvd","sourceId":"CVE-2026-104850","modified":"2026-10-06T20:03:40.690","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"}]},{"url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","origins":[{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h"}]},{"url":"https://github.com/modelcontextprotocol/typescript-sdk","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","origins":[{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://github.com/modelcontextprotocol/typescript-sdk"},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://github.com/modelcontextprotocol/typescript-sdk"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-104850","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-104850"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546663","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546663"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104850","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-104850"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104850","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104850"}]},{"source":"euvd","sourceId":"EUVD-2026-93491","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93491","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-93491","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93491"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h","ecosystem":"npm","name":"@modelcontextprotocol/sdk","purl":"pkg:npm/%40modelcontextprotocol/sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.31.0"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6qxp-vccf-f47h/GHSA-6qxp-vccf-f47h.json"},"modified":"2026-10-06T15:46:47.143033168Z","origins":[{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h"}]},{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h","ecosystem":"npm","name":"@modelcontextprotocol/client","purl":"pkg:npm/%40modelcontextprotocol/client","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6qxp-vccf-f47h/GHSA-6qxp-vccf-f47h.json"},"modified":"2026-10-06T15:46:47.143033168Z","origins":[{"source":"ghsa","sourceId":"GHSA-6qxp-vccf-f47h","modified":"2026-10-06T15:46:47.143033168Z","url":"https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"migration_toolkit_for_applications_8:mta/mta-solution-server-rhel9","product":"mta/mta-solution-server-rhel9 as a component of Migration Toolkit for Applications 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/mta-solution-server-rhel9@sha256:cff08d56550c3d272072ff72f1bac9f1f05065e4eb9810ebf9e0c6696bc544a9?repository_url=registry.redhat.io/mta/mta-solution-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_ansible_automation_platform_2:ansible-automation-platform-27/mcp-server-rhel9","product":"ansible-automation-platform-27/mcp-server-rhel9 as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/mcp-server-rhel9@sha256:e4d3dae1bff12fb56c2b660c2d748ad6993a611d59263260e40f02b45ca4d3b8?repository_url=registry.redhat.io/ansible-automation-platform-27/mcp-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_ansible_automation_platform_2:ansible-automation-platform-tech-preview/mcp-server-rhel9","product":"ansible-automation-platform-tech-preview/mcp-server-rhel9 as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/mcp-server-rhel9@sha256:8a5bb8b5a3751aec8fc24ee67ea6f920559bfc3aeac3338c675f45c923e42f3c?repository_url=registry.redhat.io/ansible-automation-platform-tech-preview/mcp-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:7b24ef41420bc79e19ff6349bb4760b2834bdc245eeb0b9191a8e77d90515a3a?repository_url=registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_openshift_dev_spaces:devspaces/code-rhel9","product":"devspaces/code-rhel9 as a component of Red Hat OpenShift Dev Spaces","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/code-rhel9@sha256:2a80ac1e2c7f68dd5b726d49b5a660959de0036d992356bb742eb08349563dec?repository_url=registry.redhat.io/devspaces/code-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_10:goose","product":"goose as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_in_execute_path","purl":"pkg:rpm/redhat/goose","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_10:goose.src","product":"goose.src as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_in_execute_path","purl":"pkg:rpm/redhat/goose?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_10:grafana","product":"grafana as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/grafana","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_10:grafana-selinux","product":"grafana-selinux as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/grafana-selinux","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_10:grafana.src","product":"grafana.src as a component of Red Hat Enterprise Linux 10","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/grafana?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_9:goose","product":"goose as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/goose","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_enterprise_linux_9:goose.src","product":"goose.src as a component of Red Hat Enterprise Linux 9","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:rpm/redhat/goose?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_hardened_images:grafana12.4.src","product":"grafana12.4.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/grafana12.4@12.4.12-0.3.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_hardened_images:grafana13.1.src","product":"grafana13.1.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/grafana13.1@13.1.7-0.1.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]},{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json","productId":"red_hat_hardened_images:grafana13.2.src","product":"grafana13.2.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/grafana13.2@13.2.3-0.1.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-104850","modified":"2026-10-23T10:31:40+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-104850.json"}]}],"vendorCoverage":{"total":15,"shown":15,"omitted":0,"source":"redhat"}}