Disclosed vulnerability
Official MCP Python SDK: rogue MCP server can obtain OAuth client credentials through missing issuer validation
AIR-2026-0266 AIR record · 2026-09-mcp-python-sdk-oauth-credential-theft
From the supporting source
trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real servicethehackernews.com
The record
Disclosed
2026-09-29
Vendor
Model Context Protocol (Anthropic-stewarded open source)
Product
MCP Python SDK
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — flaw in the SDK's OAuth handling lets a rogue MCP server capture credentials; no model action in the chain
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Malicious mcp server oauth discovery
Impact type
Credential theft, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
applications using the SDK as an MCP client over HTTP with OAuth: versions 1.9.1 to 1.29.1 and 2.0.0 to 2.1.1
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
MCP Python SDK 1.30.0 and 2.2.0 (issuer checks listed in release notes as behavior changes on 2026-09-07)
Taxonomy & references
Curator notes
Advisory GHSA-qx49-fqc8-xw99, published 2026-09-28 alongside the Cycode write-up; no CVE seen. The quote is from the news coverage of the advisory, which is the source carrying it; the advisory is listed as the authoritative record. Cycode demonstrated the full credential exchange in a test. Neither the advisory nor Cycode reports attacks using the flaw. The fix first shipped quietly in the 1.30.0 and 2.2.0 release notes, ahead of the advisory.
Supporting sources
Cite as
Enkrypt AI. "Official MCP Python SDK: rogue MCP server can obtain OAuth client credentials through missing issuer validation". AIR, AIR-2026-0266. https://agentincident.vercel.app/i/AIR-2026-0266/ (accessed 2026-10-19).