CVE-2026-116686

Name of the Vulnerable Software and Affected Versions Model Context Protocol Python SDK versions 1.10.0 through 1.29.1 Model Context Protocol Python SDK versions 2.0.0 through 2.1.1

Description When a connected server declares an outputSchema for a tool, the SDK client validates call tool results using a default resolver that fetches unresolved $ref values via HTTP, HTTPS, or file URLs from the client's network and filesystem context. This allows a server to trigger blind requests or local-file reads. Additionally, because the resolution process runs synchronously on the event loop without a timeout, a server can stall every session in the process by maintaining an open connection without sending data.

Recommendations Update Model Context Protocol Python SDK to version 1.30.0 or later for the 1.x branch. Update Model Context Protocol Python SDK to version 2.2.0 or later for the 2.x branch. As a temporary mitigation, only call tools on trusted servers or avoid using tools whose outputSchema contains an $id, or a $ref / $dynamicRef that does not start with #.