Evidence · DiggingBeagle record
MCP Python SDK wrong-resource OAuth token acceptance advisory
Python MCP SDK bearer-audience advisory specifying mcp 1.30.0/2.2.0 as corrected releases, but validate_token_resource is opt-in. Requires an issuer shared across services and no independent verifier audience check.
- Source role
- primary disclosure
Evidence record
Python MCP SDK bearer-audience advisory specifying mcp 1.30.0/2.2.0 as corrected releases, but validate_token_resource is opt-in. Requires an issuer shared across services and no independent verifier audience check.
Claim-level citations (3)
- supportsMCP Python server accepted tokens minted for a different resource: CVE-2026-116684 records resource-server audience verification omissions in the Python MCP SDK.
Advisory description; token resource validation
- supportsMCP Python server accepted tokens minted for a different resource: The advisory lists patched Python SDK versions 1.30.0 and 2.2.0, while warning that deployments may need to enable the resource validation option explicitly.
Advisory; patched versions and configuration note
- supportsMCP Python server accepted tokens minted for a different resource: The fixed Python SDK versions introduce validate_token_resource, but it remains disabled unless the operator enables it and returns the token audience; merely upgrading does not enforce audience binding.
Fix instructions, GHSA-w4fh-qvv9-3v23