Medium severity · published Oct 27, 2026
CVE-2026-116684
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
New
6.8
CVSS
–
EPSS
No
On KEV
Description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-sdk · modelcontextprotocol
>= 1.10.0, < 1.30.0; >= 2.0.0, < 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116684
github.com
https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40
github.com
https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512
github.com
https://github.com/modelcontextprotocol/python-sdk/pull/3447
github.com
https://github.com/modelcontextprotocol/python-sdk/pull/3451
github.com
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
github.com
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
More from python-sdk
8.1
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
7.6
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
7.5
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
7.1
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
6.9
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion