CVE-2026-116686: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Model Context Protocol Python SDKto a version that resolves this vulnerability.Fixed in 1.30.0 - Upgrade
Upgrade
Model Context Protocol Python SDKto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the MCP Python SDK's ClientSession, ClientSessionGroup, or Client tool calls are exposed when they process a server-declared outputSchema containing an unresolved $ref. The affected versions are 1.10.0 through versions before 1.30.0, and 2.2.0.
What does an attacker need to exploit this?
An attacker needs to operate or control an MCP server that can provide a tool output schema to the client. No client privileges are required, but exploitation requires a user to interact with the malicious server or otherwise cause the client to make its tool call.
What can the malicious server cause the client to do?
It can cause the client to resolve a $ref by requesting HTTP or HTTPS URLs reachable from the client's network context, or by reading file URLs from the client's filesystem context. Resolution is synchronous and has no timeout, so it can also stall every session in the process.
How can I remediate this issue?
Upgrade to MCP Python SDK version 1.30.0 or 2.2.0. If upgrading is not immediately possible, avoid connecting affected clients to untrusted MCP servers or servers whose tool output schemas cannot be trusted.