CVE-2026-116684 · GHSA-w4fh-qvv9-3v23
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
- Risk score
- 51/100
- CVSS
- 6.8 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serve…
- Affected
- mcp (pip) >= 2.0.0, < 2.2.0; mcp (pip) >= 1.10.0, < 1.30.0
- Fix
- Upgrade mcp to 2.2.0 or 1.30.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
mcp: Yellow, plan it in. The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or…
The flaws
- CVE-2026-116684: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server (CVSS 6.8)
- CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion (CVSS 6.9 · EPSS 0%)
- CVE-2026-116686: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas (CVSS 6.5)
- CVE-2026-116685: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVSS 5.9)
The fix
Upgrade mcp: 1.30.0 · 2.2.0 or later on your release line
Who is exposed: mcp (pip) >= 1.8.0, < 1.30.0; mcp (pip) >= 2.0.0, < 2.2.0
Where it stands
- No known exploitation
Connects to
- Same weakness: Incorrect authorisation (CWE-863). 350 other warnings in 30 days
Why it is Yellow
- CVSS 6.8 medium
- On your watchlist: python, PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| mcp | pip | >= 2.0.0, < 2.2.0 | 2.2.0 |
| mcp | pip | >= 1.10.0, < 1.30.0 | 1.30.0 |
References
- https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40
- https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512
- https://github.com/modelcontextprotocol/python-sdk/pull/3447
- https://github.com/modelcontextprotocol/python-sdk/pull/3451
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23
- https://github.com/advisories/GHSA-w4fh-qvv9-3v23
- https://github.com/advisories/GHSA-w4fh-qvv9-3v23
Original description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.
Last activity 27 Oct 2026. Patch Forecast updates every hour.