Model Context Protocol Python SDK accepts tokens for other servers
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
The Model Context Protocol Python SDK (mcp) from 1.10.0 before 1.30.0 and from 2.0.0 before 2.2.0 has an authorization flaw (CWE-863) in server bearer token authentication. When the authorization server serves multiple resources and the TokenVerifier does not validate the audience, a valid token issued for another service is accepted. A token holder can authenticate to the wrong MCP server and use the access that token grants there.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | python-sdk | 1.10.0 to before 1.30.0; 2.0.0 to before 2.2.0 | 1.30.0, 2.2.0 | Patch available | CNA |
| — | mcp (PyPI) | 2.0.0 to before 2.2.0 | 2.2.0 | Patch available | GHSA-w4fh-qvv9-3v23 |
| — | mcp (PyPI) | 1.10.0 to before 1.30.0 | 1.30.0 | Patch available | GHSA-w4fh-qvv9-3v23 |
- python-sdk VendorMLflow Affected 1.10.0 to before 1.30.0; 2.0.0 to before 2.2.0 Fixed in 1.30.0, 2.2.0 Patch available CNA
- mcp (PyPI) Vendor— Affected 2.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-w4fh-qvv9-3v23
- mcp (PyPI) Vendor— Affected 1.10.0 to before 1.30.0 Fixed in 1.30.0 Patch available GHSA-w4fh-qvv9-3v23
Remediation
Upgrade the mcp PyPI package to 1.30.0 for the 1.x line or to 2.2.0 for the 2.x line. The sources list no fixed version for Ansible Automation Orchestrator 2026, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat AI Inference Server and other products. Red Hat plans no fix for Exploit Intelligence.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA python-sdk (modelcontextprotocol) Fixed in 1.30.0, 2.2.0
- Fix · GHSA-w4fh-qvv9-3v23 mcp (PyPI) Fixed in 2.2.0 Advisory →
- Fix · GHSA-w4fh-qvv9-3v23 mcp (PyPI) Fixed in 1.30.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet: Fix deferred |
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux command line assistant | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-27 Threatist record created from CVE-2026-116684
- 2026-10-27 Alias added: GHSA-w4fh-qvv9-3v23
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
- 2026-11-02 CISA SSVC decision points changed
References
Other 8
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23
- https://github.com/modelcontextprotocol/python-sdk/pull/3447
- https://github.com/modelcontextprotocol/python-sdk/pull/3451
- https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40
- https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
- https://github.com/modelcontextprotocol/python-sdk
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-116684 · CVE Program
- CVE-2026-116684 · NVD
- FIRST EPSS
- GHSA-w4fh-qvv9-3v23 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116684 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences