CVE-2026-116684: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
In affected versions, the SDK’s server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.
References
- github.com/advisories/GHSA-w4fh-qvv9-3v23
- github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40
- github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512
- github.com/modelcontextprotocol/python-sdk/pull/3447
- github.com/modelcontextprotocol/python-sdk/pull/3451
- github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
- github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
- github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23
- nvd.nist.gov/vuln/detail/CVE-2026-116684
Code Behaviors & Features
Detect and mitigate CVE-2026-116684 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →