Security fix · CVE-2026-116684
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
Published Oct 27, 2026 · catalog updated Oct 27, 2026 · Model Context Protocol Python
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116684. EPSS is 0.36%. Act only if a listed version of Model Context Protocol Python is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Model Context Protocol Python).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium6.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.36%
- Remediation
- Version ranges on file
- Affected products
- PyPI mcp · pip mcp · pypi mcp
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses the SDK's bearer authentication ( with ), its authorization server also issues tokens for other services, and your does not check the token's audience ( ) itself. Affected versions: - 1.10.0 through 1.29.1 - 2.0.0 through 2.1.1 ### Fix Upgrade to: - 1.x: 1.30.0 or later - 2.x: 2.2.0 or later **Upgrading alone changes nothing.** The patched versions add a setting that is off unless you set it. To turn the check on, make both of these changes together: 1. Set in , with set to the audience your authorization server puts in tokens for your server. 2. Return the token's audience from as . A token for another service then gets . With only the first change, every request gets . If your already checks the audience, set to silence the deprecation warning. The setting will default to in 3.0. If you cannot upgrade yet, reject any token whose does not include your server inside . That closes the issue on every version.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI mcp1.10.0 → 1.30.0
- PyPI mcp2.0.0 → 2.2.0
- pip mcp>= 1.10.0, < 1.30.0
- pip mcp>= 2.0.0, < 2.2.0
- pypi mcpversion unspecified
How to fix CVE-2026-116684
Upgrade
CVE-2026-116684 lists a fix boundary at 1.30.0. Compare the installed build with that boundary before you change production.
Version check
Affected < 1.30.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116684. EPSS is 0.36%. Act only if a listed version of Model Context Protocol Python is installed.
Which versions are affected?
Compare what you have installed with 1.10.0 → 1.30.0, 2.0.0 → 2.2.0, >= 1.10.0, < 1.30.0, >= 2.0.0, < 2.2.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-863: Incorrect Authorization. EPSS 0.36%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · GitHub Advisory Database
Detected
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses the SDK's bearer authentication ( with ), its authorizatio
Oct 27, 2026 · GitHub Advisory Database
Fix available
mcp fixed in 2.2.0; mcp fixed in 1.30.0
Oct 27, 2026 · GitHub Advisory Database
Fix available
mcp fixed in 2.2.0
Oct 27, 2026 · GitHub Advisory Database
Fix available
mcp fixed in 1.30.0
Oct 27, 2026 · GitHub Advisory Database
Updated
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. ### Am I affected? Yes, if your HTTP server uses the SDK's bearer authentication ( with ), its authorizatio
Sources
- CVE.orgVulnerability recordCVE-2026-116684
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-116684
30-day exploitation probability 0.36%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-w4fh-qvv9-3v23
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116684
In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-w4fh-qvv9-3v23
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
osv.dev - PyPA Advisory DatabasePackage advisoryGHSA-w4fh-qvv9-3v23
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
osv.dev
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 6, 2026
- GitHub Advisory DatabaseOct 28, 2026
- OpenSSF OSV / OSV ScannerOct 28, 2026
- CVE.orgOct 28, 2026
- PyPA Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026