CVE-2026-116686

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-116686
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116686.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-116686
Aliases
Published
2026-10-27T19:29:16Z
Modified
2026-10-28T10:45:20Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116686.json"
}
References

Affected packages

Git / github.com/modelcontextprotocol/python-sdk

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/python-sdk
Events
Introduced
dced22344d80d85884df9c26281fdfe0331e9c65
Fixed
8c2fa6eabacde869d75568e33b9d466b58c2f512
Introduced
6f69a3758ebf2ee55ce050f58b470ce11af71133
Fixed
9972c21aa42054fb1450c5fc614761ed11847ec6
Fixed
5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836
Fixed
6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.10.0"
                },
                {
                    "fixed":  "1.30.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "fixed":  "2.2.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.30.0",
            "range":  [
                {
                    "fixed":  "8c2fa6eabacde869d75568e33b9d466b58c2f512"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v2.2.0",
            "range":  [
                {
                    "fixed":  "9972c21aa42054fb1450c5fc614761ed11847ec6"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.15.0
v1.*
v1.10.0
v1.10.1
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.13.0
v1.13.1
v1.14.0
v1.14.1
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.19.0
v1.20.0
v1.21.0
v1.21.1
v1.22.0
v1.23.0
v1.23.1
v1.23.2
v1.23.3
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.27.1
v1.27.2
v1.28.0
v1.28.1
v1.29.0
v1.29.1
v2.*
v2.0.0
v2.1.0
v2.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116686.json"