{"schema":"threatline.record/2","record":{"id":"CVE-2026-116684","aliases":["GHSA-w4fh-qvv9-3v23"],"summary":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","details":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses the SDK's bearer authentication (`auth=AuthSettings(...)` with `token_verifier=`), its authorization server also issues tokens for other services, and your `TokenVerifier` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `mcp` 1.10.0 through 1.29.1\n- `mcp` 2.0.0 through 2.1.1\n\n### Fix\nUpgrade to:\n\n- 1.x: `mcp` 1.30.0 or later\n- 2.x: `mcp` 2.2.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add a `validate_token_resource` setting that is off unless you set it. To turn the check on, make both of these changes together:\n\n1. Set `validate_token_resource=True` in `AuthSettings`, with `resource_server_url` set to the audience your authorization server puts in tokens for your server.\n2. Return the token's audience from `verify_token()` as `AccessToken.resource`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf your `TokenVerifier` already checks the audience, set `validate_token_resource=False` to silence the deprecation warning. The setting will default to `True` in 3.0.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verify_token()`. That closes the issue on every version.","categories":["Libraries & packages"],"product":"mcp","vendor":"modelcontextprotocol","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:07:01Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"pip","name":"mcp"},"range":">= 2.0.0, < 2.2.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:07:01Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"pip","name":"mcp"},"range":">= 1.10.0, < 1.30.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116684","source_modified_at":"2026-10-27T19:12:24.255Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"python-sdk","vendor":"modelcontextprotocol","versions":[{"version":">= 1.10.0, < 1.30.0","status":"affected"},{"version":">= 2.0.0, < 2.2.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:15:03.825987077Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"mcp","ecosystem":"PyPI","purl":"pkg:pypi/mcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.1.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:15:03.825987077Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"mcp","ecosystem":"PyPI","purl":"pkg:pypi/mcp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.30.0"}]}],"versions":["1.10.0","1.10.1","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.13.1","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.20.0","1.21.0","1.21.1","1.21.2","1.22.0","1.23.0","1.23.1","1.23.2","1.23.3","1.24.0","1.25.0","1.26.0","1.27.0","1.27.1","1.27.2","1.28.0","1.28.1","1.29.0","1.29.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:07:01Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"pip","name":"mcp"},"version":"2.2.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:07:01Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"ecosystem":"pip","name":"mcp"},"version":"1.30.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:15:03.825987077Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"mcp","ecosystem":"PyPI","purl":"pkg:pypi/mcp"},"version":"2.2.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23","source_modified_at":"2026-10-27T21:15:03.825987077Z","fetched_at":"2026-10-27T21:14:11.489891Z","package":{"name":"mcp","ecosystem":"PyPI","purl":"pkg:pypi/mcp"},"version":"1.30.0"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T19:12:24.255Z","modified_at":"2026-10-27T21:15:03.825987077Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T21:07:01Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116684","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T19:12:24.255Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T21:15:03.825987077Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3447","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3451","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T21:15:03.825987077Z","content_hash":"c13f1d8cb03c1d7aab0d1aa2767ef05f0bfa853c3ef1a2edc20317f133aaa970"}}