CVE-2026-116684

MCP Python bearer authentication lacks an enforced resource audience check

Model Context Protocol · Python SDK server bearer authentication

First documented disclosure · Review checkpoint

Summary

A valid token for another service can be accepted by the MCP resource server.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The SDK bearer gate does not bind tokens to the resource unless the application’s verifier performs that check.

Conditions required

HTTP bearer authentication, a shared authorization server and a TokenVerifier that does not independently validate aud; the caller holds a token for another service.

Potential impact

Unauthorized access to operations permitted by the accepted token’s resulting scopes.

Affected versions and configurations

mcp >=1.10.0, <1.30.0; >=2.0.0, <2.2.0.

Fix and mitigation status

1.30.0 and 2.2.0 add an opt-in check; upgrading alone does not enforce it.

Practical next steps

Enable validate_token_resource=True, set resource_server_url to the expected audience and return the token audience in AccessToken.resource. Alternatively enforce aud inside verify_token().

Operating lesson

Security options that default off require configuration verification after patching.

Evidence and limits

The public fix discussion began September 4; the maintainer advisory was published October 5 and CVE on October 27. Enabling only the option without returning the audience rejects all requests. This is separate from the AWS server advisory.

Sources