CVE-2026-116686 · GHSA-rwrf-2pqf-9j8j
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
- Risk score
- 49/100
- CVSS
- 6.5 v3.1
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref va…
- Affected
- mcp (pip) >= 2.0.0, < 2.2.0; mcp (pip) >= 1.10.0, < 1.30.0
- Fix
- Upgrade mcp to 2.2.0 or 1.30.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
mcp: Yellow, plan it in. The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or…
The flaws
- CVE-2026-116686: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas (CVSS 6.5)
- CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion (CVSS 6.9 · EPSS 0%)
- CVE-2026-116684: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server (CVSS 6.8)
- CVE-2026-116685: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVSS 5.9)
The fix
Upgrade mcp: 1.30.0 · 2.2.0 or later on your release line
Who is exposed: mcp (pip) >= 1.8.0, < 1.30.0; mcp (pip) >= 2.0.0, < 2.2.0
Where it stands
- No known exploitation
Connects to
- Same weakness: Server-side request forgery (CWE-918). 238 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: python, PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| mcp | pip | >= 2.0.0, < 2.2.0 | 2.2.0 |
| mcp | pip | >= 1.10.0, < 1.30.0 | 1.30.0 |
References
- https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836
- https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b
- https://github.com/modelcontextprotocol/python-sdk/pull/3394
- https://github.com/modelcontextprotocol/python-sdk/pull/3396
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j
- https://github.com/advisories/GHSA-rwrf-2pqf-9j8j
- https://github.com/advisories/GHSA-rwrf-2pqf-9j8j
Original description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
Last activity 27 Oct 2026. Patch Forecast updates every hour.