CVE-2026-116686 in python-sdk
Summary
by MITRE • 10/27/2026
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The Model Context Protocol Python SDK serves as the official software development kit for implementing servers and clients within the Model Context Protocol ecosystem, facilitating structured interactions between large language models and external tools or data sources. A critical security vulnerability was identified in specific versions of this library, ranging from 1.10.0 up to but not including 1.30.0, as well as version 2.2.0. This flaw resides within the core session management components, specifically affecting ClientSession, ClientSessionGroup, and the mechanism for handling client tool calls. The vulnerability stems from how these components process server-declared outputSchema documents during validation procedures. When a schema document contains unresolved $ref values, which are JSON Schema references intended to point to external definitions or schemas, the SDK utilizes jsonschema's default resolver to locate and fetch these resources.
The technical flaw lies in the unrestricted nature of this resolution mechanism. The default resolver does not impose strict limitations on the protocols or locations from which it retrieves referenced content. Consequently, if a malicious server provides an outputSchema with $ref values pointing to arbitrary Uniform Resource Identifiers, the client application will attempt to fetch these resources automatically. This behavior allows for blind Server-Side Request Forgery attacks where the victim's network context is leveraged to make HTTP or HTTPS requests to attacker-controlled domains. Furthermore, if the reference points to a file path using the file protocol, it enables local-file reads, potentially exposing sensitive configuration files, credentials, or internal application data residing on the client machine. This represents a significant breach of isolation boundaries between untrusted server inputs and trusted local environments.
Beyond information disclosure, this vulnerability introduces severe availability risks due to its synchronous execution model. The schema resolution process runs directly on the main event loop without any configurable timeout mechanism. When an attacker provides references that point to unreachable hosts or slow-responding servers, the client application becomes blocked while waiting for these network operations to complete or fail. This blocking behavior effectively stalls every active session managed by the affected ClientSessionGroup, leading to a denial of service condition. Legitimate users are unable to interact with the system because the event loop is perpetually occupied processing malicious schema resolutions, rendering the application unresponsive until manual intervention occurs or the process is terminated.
From an industry standard perspective, this vulnerability aligns closely with CWE-918, which addresses Server-Side Request Forgery (SSRF), specifically involving the retrieval of resources from unintended network locations. It also relates to CWE-400, Uncontrolled Resource Consumption, as the synchronous blocking leads to resource exhaustion and application hang. In terms of adversarial tactics, this behavior is consistent with ATT&CK technique T1583.002, Acquire Infrastructure: Domains, where attackers use legitimate services or protocols for malicious purposes, although in this case, it is more accurately described as leveraging the victim's infrastructure to probe internal networks or exfiltrate data via SSRF. The lack of timeout configuration further exacerbates the impact by facilitating denial-of-service conditions akin to T1499, Endpoint Denial of Service.
To mitigate these risks, organizations utilizing the Model Context Protocol Python SDK must immediately upgrade to version 1.30.0 or later, where this issue has been resolved. The fix likely involves implementing strict allowlists for permitted protocols and domains during schema resolution, disabling file protocol access entirely in client contexts, and introducing asynchronous execution with configurable timeouts to prevent event loop blocking. Developers should also audit their implementations of ClientSession and ClientSessionGroup to ensure that any custom validation logic adheres to these security principles. Until the upgrade is performed, it is advisable to restrict network egress from application hosts where this SDK is deployed and monitor for unusual outbound connection attempts originating from processes using vulnerable versions of the library.