CVE-2026-116684
Description
A flaw was found in the Model Context Protocol (MCP) Python SDK. This vulnerability allows a remote authenticated attacker to bypass authentication and gain unauthorized access to an MCP server by presenting a valid token issued for a different service. The issue occurs because server-side authentication does not independently validate the token's target audience claim when multiple resources share an authorization server.
Statement
Red Hat has rated this vulnerability as Moderate impact because an attacker must already possess valid credentials from a shared identity provider, and exploitation depends on a multi-service authentication topology where distinct endpoints accept tokens from the same issuer. In typical Red Hat deployments where Model Context Protocol endpoints are integrated into artificial intelligence workflows or platform services, exposure is limited to environments where single authorization servers issue generic tokens across disparate application resources. While successful exploitation permits unauthorized service interactions under the context of the supplied credential, it does not provide privilege escalation within the underlying host or container infrastructure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
