Model Context Protocol Python SDK Vulnerability Allows Remote Fetching of Resources
CVE-2026-116686
6.5MEDIUM
What is CVE-2026-116686?
The Model Context Protocol Python SDK is prone to a vulnerability that arises from improper validation of server-declared outputSchema documents. This issue, found in versions ranging from 1.10.0 to 1.30.0 and 2.2.0, allows a server to trigger unintended access to resources by sending unresolved $ref values. As a result, the SDK may attempt to fetch HTTP, HTTPS, or file URLs from the client's environment. This blind request capability can lead to local file reads and potentially stall sessions, as the resolution process runs synchronously without a timeout on the event loop. This vulnerability has been addressed in versions 1.30.0 and 2.2.0.
Affected Version(s)
python-sdk >= 1.10.0, < 1.30.0 < 1.10.0, 1.30.0
python-sdk >= 2.0.0, < 2.2.0 < 2.0.0, 2.2.0