REPORTED DEVELOPMENT
Maintainers of the Model Context Protocol Python SDK published a security advisory identifying weaknesses in the handling of OAuth credentials under specified configurations.
The advisory explains that affected OAuth-enabled clients could accept insufficiently validated authorisation-server information supplied through an MCP server.
Under the relevant conditions, this could result in credentials or authentication-related information being sent to an unintended destination.
The advisory identifies affected versions within the 1.x and 2.x package branches, with corrections provided in versions 1.30.0 and 2.2.0 respectively.
Additional MCP SDK security advisories published in early October addressed separate authentication and transport-related issues.
The identified risks are conditional on the software version, configuration and interaction with the relevant systems. They do not establish that all MCP integrations are vulnerable or that a particular enterprise has experienced a security incident.
WHY IT MATTERS TO THE MARKET
AI agents increasingly connect business applications, external tools, enterprise data and third-party services.
These integrations introduce security dependencies that must be assessed beyond the capabilities of the AI model itself.
For enterprises adopting agentic software, supplier assessment should include authentication mechanisms, trusted endpoints, software versions, configuration requirements and security maintenance.
A software update may address a reported vulnerability without eliminating the need for correct operational configuration.