CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116686?
CVE-2026-116686 is a medium-severity vulnerability in modelcontextprotocol python-sdk, published on 27 Oct 2026.
Official description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-116686?
4 open source packages ship an affected version, including mcp.
| Package | Affected | Fixed in |
|---|---|---|
mcp PyPI | From 1.10.0 | 1.30.0 |
mcp PyPI | From 1.10.0 | 1.30.0 |
mcp PyPI | From 2.0.0 | 2.2.0 |
mcp PyPI | From 2.0.0 | 2.2.0 |
How do I fix CVE-2026-116686?
Upgrade mcp to a fixed version for your release line: 1.30.0 or 2.2.0.
Is CVE-2026-116686 being exploited?
There is no known exploitation of CVE-2026-116686 in the wild and no public exploit code.
Sources
Also known as GHSA-rwrf-2pqf-9j8j.