ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116686

Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · Model Context Protocol Python

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116686. EPSS is 0.34%. Act only if a listed version of Model Context Protocol Python is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Model Context Protocol Python).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Version ranges on file
Affected products
PyPI mcp · pip mcp · pypi mcp

### Summary In affected versions, when a connected MCP server declared an for a tool, the SDK's client validated each result with 's default resolver, which fetches any it cannot resolve locally by opening the URL. A server could therefore put an , or reference in a tool's output schema and make the client: - request that URL, or read that local file, from the client's own network position on every call of the tool (the content was used only as a schema and never sent back to the server), and - stall: the fetch ran synchronously on the event loop with no timeout, so a target that accepted the connection and then went quiet froze every session in the process for as long as it held the connection. ### Am I affected? Yes, if your application uses the SDK as an MCP client ( over any transport, , or the 2.x ) and calls tools on servers you do not fully control. There was no setting that turned the validation off. Affected versions: 1.10.0 through 1.29.1, and 2.0.0 through 2.1.1. Not affected: applications that only build servers. If nothing in your code uses , or the 2.x class, you are not affected. ### Fix Upgrade to 1.30.0 (1.x) or 2.2.0 (2.x) or later. The client now resolves references only within the schema document the server sent (plus the standard JSON Schema metaschemas), so result validation performs no network or file access. A tool whose output schema points outside its own document fails at call time with ( ); in-document references such as work as before. Until you can upgrade, call tools only on servers you trust. As a partial stopgap, skip tools whose contains an , or a / that does not start with .

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI mcp1.10.0 → 1.30.0
  • PyPI mcp2.0.0 → 2.2.0
  • pip mcp>= 1.10.0, < 1.30.0
  • pip mcp>= 2.0.0, < 2.2.0
  • pypi mcpversion unspecified

How to fix CVE-2026-116686

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-116686. EPSS is 0.34%. Act only if a listed version of Model Context Protocol Python is installed.

Which versions are affected?

Compare what you have installed with 1.10.0 → 1.30.0, 2.0.0 → 2.2.0, >= 1.10.0, < 1.30.0, >= 2.0.0, < 2.2.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-918: Server-Side Request Forgery (SSRF). EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · GitHub Advisory Database

    Detected

    ### Summary In affected versions, when a connected MCP server declared an for a tool, the SDK's client validated each result with 's default resolver, which fetches any it cannot resolve locally by opening the URL. A server could therefore put an , or reference in a tool's output schema and make the client: - request that URL, or read that local file, from the client's own network position on ever

  2. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    mcp fixed in 2.2.0; mcp fixed in 1.30.0

  3. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    mcp fixed in 2.2.0

  4. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    mcp fixed in 1.30.0

  5. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ### Summary In affected versions, when a connected MCP server declared an for a tool, the SDK's client validated each result with 's default resolver, which fetches any it cannot resolve locally by opening the URL. A server could therefore put an , or reference in a tool's output schema and make the client: - request that URL, or read that local file, from the client's own network position on ever

Sources

  • CVE.orgVulnerability recordCVE-2026-116686

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-116686

    30-day exploitation probability 0.34%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-rwrf-2pqf-9j8j

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116686

    In affected versions, when a connected MCP server declared an outputSchema for a tool, the SDK's client validated each call_tool result with jsonschema's default resolver, which fetches any $ref it cannot resolve locally by opening the URL. A server could therefore put an http://, https:// or file:// reference in a tool's output schema and make the client: request that URL, or read that local file

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-rwrf-2pqf-9j8j

    Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

    osv.dev
  • PyPA Advisory DatabasePackage advisoryGHSA-rwrf-2pqf-9j8j

    Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

    osv.dev

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • GitHub Advisory DatabaseOct 28, 2026
  • OpenSSF OSV / OSV ScannerOct 28, 2026
  • CVE.orgOct 28, 2026
  • PyPA Advisory DatabaseOct 28, 2026
  • GitLab Advisory DatabaseOct 28, 2026