# CVE-2026-116684: Model Context Protocol Python SDK token resource confusion in bearer authentication

Source: https://junglewise.ai/threats/cve-2026-116684-the-model-context-protocol-python-sdk-is-the-official-python-sdk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116684 · Severity: medium · CVSS 6.8 · Published 2026-10-27

The Model Context Protocol Python SDK is a library that enables Python applications to implement servers and clients for the MCP protocol, which coordinates AI interactions. A flaw in its bearer token authentication allows a token issued for one service to authenticate to a different MCP server when multiple services share the same authorization server, potentially allowing unauthorized access. An attacker holding a valid token for any service could gain access to a different MCP server if it doesn't independently validate token audience claims.

Technologies: [Anthropic Model Context Protocol Python SDK](https://junglewise.ai/threats/technologies/anthropic-model-context-protocol-python-sdk), [mcp (PyPI)](https://junglewise.ai/threats/technologies/pypi-mcp). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116684 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116684 being exploited in the wild.

**How severe is CVE-2026-116684?** Medium severity, with a CVSS score of 6.8, published 27 October 2026.

**Which products and versions are affected?** Anthropic Model Context Protocol Python SDK 1.10.0 to 1.30.0 (exclusive), 2.0.0 to 2.2.0 (exclusive); mcp (PyPI) >= 2.0.0, < 2.2.0, ECOSYSTEM:introduced=2.0.0,fixed=2.2.0.

**Is there a fix for CVE-2026-116684?** Yes. mcp (PyPI): upgrade to 2.2.0 or later. Until then: Set AuthSettings.validate_token_resource=True to enforce bearer token audience validation against resource_server_url, or ensure your TokenVerifier independently validates the token's 'aud' claim. Version 3.0 will make validation the default; for now unset validation defaults to False. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116684 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116684?** Check whether you run Anthropic Model Context Protocol Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mcp (PyPI): upgrade to 2.2.0 or later

  ```sh
  pip install "mcp>=2.2.0"
  ```


Set AuthSettings.validate_token_resource=True to enforce bearer token audience validation against resource_server_url, or ensure your TokenVerifier independently validates the token's 'aud' claim. Version 3.0 will make validation the default; for now unset validation defaults to False.

## Technical details

This is a resource-confusion vulnerability in the AuthSettings class where server-side bearer token verification via token_verifier does not validate the 'aud' (audience) claim when the authorization server handles multiple resource servers. An attacker with a valid token issued for service A can present it to service B if service B relies solely on the verifier's token validation without checking the token's audience against resource_server_url. The fix requires setting validate_token_resource=True in AuthSettings to enforce audience validation, or ensuring the TokenVerifier independently checks the aud claim.

## Affected products

- Anthropic Model Context Protocol Python SDK 1.10.0 to 1.30.0 (exclusive), 2.0.0 to 2.2.0 (exclusive)

## Identifiers

- CVE-2026-116684
- GHSA-w4fh-qvv9-3v23

## Timeline

- 2026-10-27: disclosed
- 2026-09-05: patched

## References

- [https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40](https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40)
- [https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512](https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512)

## Related threats

- [Model Context Protocol Python SDK unvalidated $ref fetching](https://junglewise.ai/threats/cve-2026-116686-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [Model Context Protocol Python SDK credential and body leak on cross-origin redirects](https://junglewise.ai/threats/cve-2026-116685-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [MCP Python SDK unbounded session accumulation in StreamableHTTP](https://junglewise.ai/threats/cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in-streamablehttp)
- [modelcontextprotocol python-sdk missing origin validation in WebSocket transport](https://junglewise.ai/threats/cve-2026-59950-modelcontextprotocol-python-sdk-missing-origin-validation-in)
- [Model Context Protocol Python SDK missing authorization in experimental tasks](https://junglewise.ai/threats/cve-2026-52870-model-context-protocol-python-sdk-missing-authorization-in)