---
id: "CVE-2026-116686"
kind: "vulnerability"
aliases: ["CVE-2026-116686", "GHSA-rwrf-2pqf-9j8j"]
title: "Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mcp", "fixed": ["2.2.0"], "affected": ">= 2.0.0, < 2.2.0", "ecosystem": "pypi"}, {"name": "mcp", "fixed": ["1.30.0"], "affected": ">= 1.10.0, < 1.30.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-agents", "ai-tooling", "cwe-918", "mcp", "python"]
not_affected_if: ["default-config"]
published_at: "2026-10-27T20:17:13+00:00"
first_seen_at: "2026-10-27T20:33:27+00:00"
updated_at: "2026-10-27T21:09:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116686", "first_seen_at": "2026-10-27T20:33:27+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-rwrf-2pqf-9j8j", "first_seen_at": "2026-10-27T21:09:20+00:00"}]
---

# Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

The official Model Context Protocol Python SDK resolves $ref values in server-declared outputSchema documents with a default resolver. A malicious MCP server can make the client fetch HTTP, HTTPS or local file URLs, and block the event loop without a timeout.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mcp affected >= 2.0.0, < 2.2.0 fixed 2.2.0
- pypi:mcp affected >= 1.10.0, < 1.30.0 fixed 1.30.0

## How to check

- Check the installed SDK version with `pip show mcp` and confirm whether it is between `1.10.0` and `1.30.0` or `2.0.0` to `2.2.0`
- Search the project lock files for `mcp` to find every service that uses the SDK

## Fix

- Upgrade the `mcp` Python package to `1.30.0` or `2.2.0`
- Rebuild and redeploy services that bundle the SDK

## Timeline

- 2026-10-27T20:33:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116686
- 2026-10-27T21:09:20+00:00 ghsa https://github.com/advisories/GHSA-rwrf-2pqf-9j8j

## From the sources

### Summary
In affected versions, when a connected MCP server declared an `outputSchema` for a tool, the SDK's client validated each `call_tool` result with `jsonschema`'s default resolver, which fetches any `$ref` it cannot resolve locally by opening the URL. A server could therefore put an `http://`, `https://` or `file://` reference in a tool's output schema and make the client:

- request that URL, or read that local file, from the client's own network position on every call of the tool (the content was used only as a schema and never sent back to the server), and
- stall: the fetch ran synchronously on the event loop with no timeout, so a target that accepted the connection and then went quiet froze every session in the process for as long as it held the connection.

### Am I affected?
Yes, if your application uses the SDK as an MCP client (`ClientSession` over any transport, `ClientSessionGroup`, or the 2.x `Client`) and calls tools on servers you do not fully control. There was no setting that turned the validation off.

Affected versions: 1.10.0 through 1.29.1, and 2.0.0 through 2.1.1.

Not affected: applications that only build servers. If nothing in your code uses `ClientSession`, `ClientSessionGroup` or the 2.x `Client` class, you are not affected.

### Fix
Upgrade to `mcp` 1.30.0 (1.x) or 2.2.0 (2.x) or later. The client now resolves references only within the schema document the server sent (plus the standard JSON Schema metaschemas), so result validation performs no network or file access. A tool whose output schema points outside its own document fails at call time with `RuntimeError` (`Invalid schema for tool ...`); in-document references such as `#/$defs/...` work as before.

Until you can upgrade, call tools only on servers you trust. As a partial stopgap, skip tools whose `outputSchema` contains an `$id`, or a `$ref` / `$dynamicRef` that does not start with `#`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_