CVE-2026-116684mediumCWE-863

CVE-2026-116684: falha de média gravidade em modelcontextprotocol python-sdk

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar python-sdk+ Monitorar mcp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.4%
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
modelcontextprotocol · python-sdk
CVEs relacionadas — modelcontextprotocol python-sdk

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 9.8%CVE-2026-109527HIGHModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesEPSS 0.7%CVE-2025-66416HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-52869HIGHMCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalEPSS 0.5%CVE-2026-59951MEDIUMMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionEPSS 0.5%CVE-2025-53365HIGHMCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of ServiceEPSS 0.4%