strands_agents_evals-1.8.0-py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - strands_agents_evals-1.8.0-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary-llm/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary-llm/.venv/lib/python3.10/site-packages/mcp-2.1.1.dist-info

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

WS-2026-0089

Vulnerable Library - mcp-2.1.1-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/50/af/8644cc5fa26a59afd2df2e98eeb19e72926887fa4b7441aba4ff661140db/mcp-2.1.1-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary-llm/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary-llm/.venv/lib/python3.10/site-packages/mcp-2.1.1.dist-info

Dependency Hierarchy:

• strands_agents_evals-1.8.0-py3-none-any.whl (Root Library)
  • strands_agents-1.62.0-py3-none-any.whl
    • ❌ mcp-2.1.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Found in base branch: main

Vulnerability Details

In mcp (MCP Python SDK) 1.9.1 through 1.29.1 and 2.0.0a1 through 2.1.1, the OAuth client (mcp.client.auth) did not validate the authorization server metadata issuer on every discovery path and did not bind stored or pre-provisioned client credentials to their authorization server. A malicious or compromised MCP server could direct the client to a token endpoint of its choosing and receive the client_secret, authorization code and PKCE code_verifier (or a signed client assertion) meant for the real authorization server. Fixed in 1.30.0 and 2.2.0.

Publish Date: 2026-09-28

URL: WS-2026-0089

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-28

Fix Resolution: mcp - 2.2.0

CVE-2026-116684

Vulnerable Library - mcp-2.1.1-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/50/af/8644cc5fa26a59afd2df2e98eeb19e72926887fa4b7441aba4ff661140db/mcp-2.1.1-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary-llm/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary-llm/.venv/lib/python3.10/site-packages/mcp-2.1.1.dist-info

Dependency Hierarchy:

• strands_agents_evals-1.8.0-py3-none-any.whl (Root Library)
  • strands_agents-1.62.0-py3-none-any.whl
    • ❌ mcp-2.1.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-27

URL: CVE-2026-116684

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-27

Fix Resolution: mcp - 2.2.0

CVE-2026-116686

Vulnerable Library - mcp-2.1.1-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/50/af/8644cc5fa26a59afd2df2e98eeb19e72926887fa4b7441aba4ff661140db/mcp-2.1.1-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary-llm/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary-llm/.venv/lib/python3.10/site-packages/mcp-2.1.1.dist-info

Dependency Hierarchy:

• strands_agents_evals-1.8.0-py3-none-any.whl (Root Library)
  • strands_agents-1.62.0-py3-none-any.whl
    • ❌ mcp-2.1.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-27

URL: CVE-2026-116686

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-27

Fix Resolution: mcp - 2.2.0

CVE-2026-116685

Vulnerable Library - mcp-2.1.1-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/50/af/8644cc5fa26a59afd2df2e98eeb19e72926887fa4b7441aba4ff661140db/mcp-2.1.1-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary-llm/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary-llm/.venv/lib/python3.10/site-packages/mcp-2.1.1.dist-info

Dependency Hierarchy:

• strands_agents_evals-1.8.0-py3-none-any.whl (Root Library)
  • strands_agents-1.62.0-py3-none-any.whl
    • ❌ mcp-2.1.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-27

URL: CVE-2026-116685

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-27

Fix Resolution: mcp - 2.2.0

CVE-2026-59951

Vulnerable Library - mcp-2.1.1-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/50/af/8644cc5fa26a59afd2df2e98eeb19e72926887fa4b7441aba4ff661140db/mcp-2.1.1-py3-none-any.whl

Sample Path to Dependency File: /docker-compose/agent-eval-canary-llm/pyproject.toml

Path to vulnerable library: /docker-compose/agent-eval-canary-llm/.venv/lib/python3.10/site-packages/mcp-2.1.1.dist-info

Dependency Hierarchy:

• strands_agents_evals-1.8.0-py3-none-any.whl (Root Library)
  • strands_agents-1.62.0-py3-none-any.whl
    • ❌ mcp-2.1.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Found in base branch: main

Vulnerability Details

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-14

URL: CVE-2026-59951

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-30

Fix Resolution: mcp - 2.2.0