SB20261109194 - Multiple vulnerabilities in MCP Python SDK

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109194

SB20261109194 - Multiple vulnerabilities in MCP Python SDK

Published: November 9, 2026

Security Bulletin ID SB20261109194
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-116686)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to force client-side network requests and freeze all sessions in an MCP Python SDK client process.

The vulnerability exists due to unrestricted synchronous external reference resolution during tool result validation after a user adds a malicious MCP server and approves tool calls. An unauthenticated remote attacker can supply an outputSchema referencing a URL that accepts connections without responding, blocking the client's event loop indefinitely.


2) Insufficient verification of data authenticity (CVE-ID: CVE-2026-115563)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to steal OAuth credentials from MCP Python SDK clients.

The vulnerability exists due to missing authorization server issuer validation and credential binding in the SDK's OAuth client support when clients holding legitimate authorization server credentials connect to untrusted MCP servers over HTTP. An unauthenticated remote attacker can control an MCP server's discovery metadata to direct the client's credentials to an attacker-controlled token endpoint instead of the legitimate authorization server.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59951)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust server memory and cause denial of service.

The vulnerability exists due to unlimited session creation and missing reclamation of session state and initialization payloads in the MCP Python SDK's default stateful Streamable HTTP mode. An unauthenticated remote attacker can repeatedly send ordinary short requests to a reachable endpoint to accumulate retained sessions and grow server memory without bound.


4) Information disclosure (CVE-ID: CVE-2026-116685)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to capture credentials in custom headers and sensitive request bodies sent by MCP Python SDK clients.

The vulnerability exists due to unrestricted cross-origin redirect following in the HTTP transports and OAuth providers when a trusted endpoint redirects requests to another origin. An unauthenticated remote attacker can influence that endpoint's redirects to receive custom headers and, with HTTP 307 or 308 redirects, replayed request bodies.


5) Incorrect authorization (CVE-ID: CVE-2026-116684)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to gain unauthorized access to an MCP server using a token issued for another service.

The vulnerability exists due to missing audience validation in MCP Python SDK HTTP bearer authentication when one authorization server serves multiple services and the token verifier does not check audiences. A low-privileged remote attacker can submit a valid token for another service and have it accepted by the MCP server.


Remediation

Install update from vendor's website.

References