The report
The Python Model Context Protocol SDK has three security advisories with an unusually useful lesson: upgrading an agent protocol library does not establish that every identity, network and parsing boundary is enforced. The disclosed issues affect different interfaces, and one corrected behavior still depends on an operator setting.
| Issue | Failure boundary | What is established |
|---|---|---|
| CVE-2026-116684 | OAuth resource audience | A valid token for one resource could be accepted by another resource server using the same issuer |
| CVE-2026-116685 | HTTP redirect origin | Custom credential headers and certain request bodies could follow a cross-origin redirect |
| CVE-2026-116686 | JSON Schema reference resolver | Server-chosen external references could make the client read local files or request external URLs |
The upgrade is not the whole audience fix
Versions 1.30.0 and 2.2.0 contain fixes for these disclosures. For token validation, however, the SDK's validate_token_resource option is not enabled automatically. Operators must enable it and supply the resource audience where applicable. Otherwise a patched installation may still lack the audience check that prevents token use at the wrong server. Audience advisory.
The redirect advisory is narrower than a general claim that every OAuth bearer token leaked. The underlying HTTP client already withheld the standard Authorization header when crossing origins; custom X-API-Key headers and bodies on 307/308 redirects remained exposed in the described paths. Redirect details.
External schema resolution also needs a precise description: loading a file: reference can disclose data to the client process or hang validation, but the advisory does not show that those file bytes were automatically sent back to the server. Schema-read limits.
These are independent acceptance tests: bind bearer tokens to the intended resource, prohibit credential-bearing redirects across origins, and make schema validation local and bounded. Their common protocol label is not a substitute for testing each trust crossing against its own proof. Primary SDK advisories.