CVE-2026-116684
mediumThe Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c978... security-advisories@github.com
- https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b... security-advisories@github.com
- https://github.com/modelcontextprotocol/python-sdk/pull/3447 security-advisories@github.com
- https://github.com/modelcontextprotocol/python-sdk/pull/3451 security-advisories@github.com
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0 security-advisories@github.com
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0 security-advisories@github.com
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23 security-advisories@github.com