CVE-2026-116686 Details
Description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
A vulnerability exists in the Model Context Protocol Python SDK, specifically in versions 1.10.0 prior to 1.30.0 and 2.0.0 prior to 2.2.0. The issue arises because the SDK's client validates tool results against server-declared output schemas using jsonschema's default resolver. This can lead to unresolved $ref references causing the client to fetch HTTP, HTTPS, or file URLs from its own network or filesystem. As a result, a server could trigger blind requests or local file reads. Furthermore, the synchronous nature of this resolution process, which lacks a timeout, can freeze all active sessions. The vulnerability has been addressed in versions 1.30.0 and 2.2.0 of the SDK.
Upgrade to Model Context Protocol Python SDK version 1.30.0 or 2.2.0 and later. After the upgrade, the SDK will only resolve references within the output schema document provided by the server, preventing any network or file access during validation. Tools with output schemas referencing external documents will fail with a 'RuntimeError' indicating an invalid schema.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Model Context Protocol Python SDK | >= 2.0.0, < 2.2.0 (semver) >= 1.10.0, < 1.30.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |