CVE-2026-116684 modelcontextprotocol CVE debrief

Who should care

Defenders who use the Model Context Protocol Python SDK's bearer authentication in their HTTP servers should assess exposure, especially if their authorization server issues tokens for other services.

Why it matters

The Model Context Protocol Python SDK vulnerability allows tokens issued for different resource servers to be accepted, potentially leading to unauthorized access. Defenders should prioritize upgrading to patched versions and configuring the `validate_token_resource` setting to prevent this issue.

• Defenders need to verify if their HTTP servers use the affected SDK versions and configure the `validate_token_resource` setting to prevent unauthorized access.
• The vulnerability allows tokens issued for different resource servers to be accepted, potentially leading to unauthorized access.
• Defenders should prioritize upgrading to patched versions and configuring the `validate_token_resource` setting.
• The patched versions require configuration changes to enable the token resource validation.

Technical summary

The Model Context Protocol Python SDK's server-side bearer authentication does not check if a token was issued for the specific server (its audience). This allows a valid token for another service to be accepted when the authorization server issues tokens for multiple services. The vulnerability affects versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 of the `mcp` package. To fix this, upgrade to version 1.30.0 or later for 1.x, or version 2.2.0 or later for 2.x, and configure the `validate_token_resource` setting.

Defensive priority

Defenders should prioritize upgrading to the patched versions and configuring the `validate_token_resource` setting to prevent unauthorized access.

Recommended defensive actions

• Upgrade to version 1.30.0 or later for 1.x, or version 2.2.0 or later for 2.x
• Configure the `validate_token_resource` setting with `resource_server_url` set to the audience your authorization server puts in tokens for your server
• Return the token's audience from `verify_token()` as `AccessToken.resource`
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability allows a valid token for another service to be accepted by the MCP server when the authorization server issues tokens for several services. The patched versions add a `validate_token_resource` setting that must be enabled to turn on the check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.