Incorrect authorization in MCP Python SDK - CVE-2026-116684
Published: November 9, 2026
Vulnerability identifier: #VU163096
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116684
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to gain unauthorized access to an MCP server using a token issued for another service.
The vulnerability exists due to missing audience validation in MCP Python SDK HTTP bearer authentication when one authorization server serves multiple services and the token verifier does not check audiences. A low-privileged remote attacker can submit a valid token for another service and have it accepted by the MCP server.
Affected software
MCP Python SDK
How to mitigate CVE-2026-116684
Install security update from vendor's website.
MCP Python SDK - addressed in versions 1.30.0, 2.2.0