CVE-2026-116684: Model Context Protocol Python SDK token resource confusion in bearer authentication

CVE-2026-116684 · Severity: medium · CVSS 6.8 · Published 2026-10-27

The Model Context Protocol Python SDK is a library that enables Python applications to implement servers and clients for the MCP protocol, which coordinates AI interactions. A flaw in its bearer token authentication allows a token issued for one service to authenticate to a different MCP server when multiple services share the same authorization server, potentially allowing unauthorized access. An attacker holding a valid token for any service could gain access to a different MCP server if it doesn't independently validate token audience claims.

Technologies: Anthropic Model Context Protocol Python SDK, mcp (PyPI). Vendors: Anthropic, PyPI.

Quick answers

Is CVE-2026-116684 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116684 being exploited in the wild.
How severe is CVE-2026-116684?
Medium severity, with a CVSS score of 6.8, published 27 October 2026.
Which products and versions are affected?
Anthropic Model Context Protocol Python SDK 1.10.0 to 1.30.0 (exclusive), 2.0.0 to 2.2.0 (exclusive); mcp (PyPI) >= 2.0.0, < 2.2.0, ECOSYSTEM:introduced=2.0.0,fixed=2.2.0.
Is there a fix for CVE-2026-116684?
Yes. mcp (PyPI): upgrade to 2.2.0 or later. Until then: Set AuthSettings.validate_token_resource=True to enforce bearer token audience validation against resource_server_url, or ensure your TokenVerifier independently validates the token's 'aud' claim. Version 3.0 will make validation the default; for now unset validation defaults to False. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116684 attacked?
It is attacked over the network.
Am I affected by CVE-2026-116684?
Check whether you run Anthropic Model Context Protocol Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp (PyPI): upgrade to 2.2.0 or later
    pip install "mcp>=2.2.0"

Set AuthSettings.validate_token_resource=True to enforce bearer token audience validation against resource_server_url, or ensure your TokenVerifier independently validates the token's 'aud' claim. Version 3.0 will make validation the default; for now unset validation defaults to False.

Technical details

This is a resource-confusion vulnerability in the AuthSettings class where server-side bearer token verification via token_verifier does not validate the 'aud' (audience) claim when the authorization server handles multiple resource servers. An attacker with a valid token issued for service A can present it to service B if service B relies solely on the verifier's token validation without checking the token's audience against resource_server_url. The fix requires setting validate_token_resource=True in AuthSettings to enforce audience validation, or ensuring the TokenVerifier independently checks the aud claim.

Affected products

  • Anthropic Model Context Protocol Python SDK 1.10.0 to 1.30.0 (exclusive), 2.0.0 to 2.2.0 (exclusive)

Identifiers

  • CVE-2026-116684
  • GHSA-w4fh-qvv9-3v23

Timeline

  • 2026-10-27: disclosed
  • 2026-09-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.