Medium severity · published Oct 27, 2026
CVE-2026-116686
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
New
6.5
CVSS
–
EPSS
No
On KEV
Description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-sdk · modelcontextprotocol
>= 1.10.0, < 1.30.0; >= 2.0.0, < 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116686
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116686
github.com
https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836
github.com
https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b
github.com
https://github.com/modelcontextprotocol/python-sdk/pull/3394
github.com
https://github.com/modelcontextprotocol/python-sdk/pull/3396
github.com
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
github.com
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
More from python-sdk
8.1
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
7.6
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
7.5
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
7.1
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
6.9
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion