MCP Python SDK flaw let servers accept tokens meant for others
A flaw in the official MCP Python SDK could let a server accept tokens issued for another service. Patched versions exist, but the fix must be turned on.
The maintainers of the official Model Context Protocol (MCP) Python SDK published a security advisory on 5 October 2026 about how servers check access tokens. The SDK's bearer authentication could not confirm who a token was issued for, so a valid token meant for one service could also be accepted by an MCP server. The issue is tracked as CVE-2026-116684, and the OSV database listed it on 27 October. It is rated moderate, with a CVSS score of 6.8.
Why it matters
MCP is a common way to connect AI assistants to tools and data, and many teams now run their own MCP servers. A token normally carries an audience field saying which service it is for. If a server ignores that field, anyone holding a valid token for a different service can reach that server.
A server is exposed only when three things are true:
- It is an HTTP server using the SDK's bearer authentication, with AuthSettings and a token_verifier.
- Its authorization server also issues tokens for other services.
- Its token verifier does not check the audience itself.
Versions 1.10.0 to 1.29.1 and 2.0.0 to 2.1.1 are affected. The fix arrived in 1.30.0 and 2.2.0. The advisory does not say whether the flaw has been exploited.
There is one catch. The new check is off by default, and the advisory is direct about it: "Upgrading alone changes nothing." It becomes the default in version 3.0.
What you can do
Most people who only use an AI app have nothing to do. This is for teams that build or host MCP servers in Python.
- Check which mcp package version your servers run, and upgrade to 1.30.0, 2.2.0 or later.
- Set validate_token_resource=True in AuthSettings, with resource_server_url set to the audience your authorization server uses.
- Return the token's audience from verify_token() as AccessToken.resource. The advisory says to do this together with the setting above.
- If you cannot upgrade, reject any token in verify_token() whose audience does not include your server. The advisory says this works on all versions.
- If you use a hosted MCP server, ask the provider whether it has applied this change.
Sources
Source: GitHub Security Advisory