CVE-2026-116684: Model Context Protocol Python SDK resource-confusion authentication flaw

# CVE-2026-116684: Model Context Protocol Python SDK resource-confusion authentication flaw

https://gcdradar.vercel.app/incidents/cve-2026-116684-model-context-protocol-python-sdk-resource-c · AIR-2026-1588 · closed 2026-10-27

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): CVE advisory with patches and no confirmed exploitation.
- Fix status: Patched
- First reported: 2026-10-27
- AI role: Attack on AI
- Products: Model Context Protocol Python SDK
- CVE ids: CVE-2026-116684
- CVSS: 6.8

## Summary

Server-side bearer authentication in the Model Context Protocol Python SDK fails to independently validate token audiences when multiple resources share an authorization server. This allows token holders to improperly authenticate and interact with incorrect MCP servers.

## What to do

Update to version 1.30.0 or 2.2.0.

## Affected and fixed versions

- Affected: 1.0.0 to 1.29.x
- Affected: 2.0.0 to 2.1.x
- Fixed in: 1.30.0
- Fixed in: 2.2.0

## Latest updates

- 2026-10-27: GitHub advisory published (https://github.com/advisories/GHSA-w4fh-qvv9-3v23)
- 2026-10-27: CVE-2026-116684: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. (https://nvd.nist.gov/vuln/detail/CVE-2026-116684)

## Sources

- 2026-10-27 NVD: CVE-2026-116684: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. https://nvd.nist.gov/vuln/detail/CVE-2026-116684
- 2026-10-27 GitHub Advisory Database: CVE-2026-116684: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server https://github.com/advisories/GHSA-w4fh-qvv9-3v23

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.