# CVE-2026-116686: CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol…

> Source: <https://dev.to/cverports/cve-2026-116686-cve-2026-116686-server-side-request-forgery-and-synchronous-denial-of-service-in-5a12>
> Published: 2026-10-28 06:30:50+00:00

# 
  
  
  CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol Python SDK

**Vulnerability ID:** CVE-2026-116686

**CVSS Score:** 6.5

**Published:** 2026-10-27

CVE-2026-116686 is a Server-Side Request Forgery (SSRF) and Denial of Service (DoS) vulnerability in the official Model Context Protocol (MCP) Python SDK (mcp package on PyPI). When an MCP client validates structured tool execution results against a server-provided outputSchema, the SDK invokes the Python jsonschema library with its default URI resolution configuration. An untrusted or compromised MCP server can supply an outputSchema containing external $ref directives (using http://, https://, or file:// schemes), forcing the client process to synchronously fetch internal network resources, read local files, or block the main event loop indefinitely.

## 
  
  
  TL;DR

The Model Context Protocol (MCP) Python SDK (versions 1.10.0 to 1.29.1 and 2.0.0 to 2.1.1) resolves external $ref URIs when validating tool results against server-supplied output schemas. Connecting to a malicious MCP server and calling a tool allows the server to trigger blind SSRF, probe local files, or freeze the client application's asynchronous event loop via synchronous network requests without timeouts. Upgrade to mcp 1.30.0 or 2.2.0 to restrict schema resolution to in-document references.

### 
  
  
  ⚠️ Exploit Status: POC

## 
  
  
  Technical Details

- 
**Vulnerability Type** : CWE-918: Server-Side Request Forgery (SSRF) & Synchronous Event-Loop DoS
- 
**CVSS v3.1 Score** : 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
- 
**Affected Package** : mcp (PyPI) >= 1.10.0, < 1.30.0 and >= 2.0.0, < 2.2.0
- 
**Patched Versions** : mcp 1.30.0 (v1.x) and mcp 2.2.0 (v2.x)
- 
**Affected Component** : src/mcp/client/session.py (validate_tool_result / _validate_tool_result)
- 
**Attack Vector** : Network (Untrusted MCP Server returning crafted Tool.outputSchema)
- 
**Primary Impact** : Blind SSRF, Local File Probing (file://), Process-wide Event Loop Freezing
- 
**CISA KEV Status** : Not Listed

## 
  
  
  Affected Systems

- Model Context Protocol Python SDK (PyPI: mcp) >= 1.10.0, < 1.30.0
- Model Context Protocol Python SDK (PyPI: mcp) >= 2.0.0, < 2.2.0
- 
**mcp (Model Context Protocol Python SDK)** : >= 1.10.0, < 1.30.0 (Fixed in:`1.30.0` )
- 
**mcp (Model Context Protocol Python SDK)** : >= 2.0.0, < 2.2.0 (Fixed in:`2.2.0` )

## 
  
  
  Code Analysis

Resolve tool output-schema references within the schema document only (#3394)

[v1.x] Resolve tool output-schema references within the schema document only (#3396)

## 
  
  
  Mitigation Strategies

- Upgrade the mcp Python SDK to version 1.30.0 (for 1.x environments) or 2.2.0 (for 2.x environments) to enforce isolated in-memory JSON Schema reference resolution.
- Restrict MCP client connections exclusively to vetted, trusted MCP servers until the SDK upgrade is deployed.
- Implement client-side schema sanitization middleware to inspect Tool.outputSchema definitions and block any tool containing $id attributes or non-fragment $ref / $dynamicRef URIs (URIs not starting with '#').
- Apply network egress filtering on hosts running MCP clients to block unauthorized connections to link-local cloud metadata services (169.254.169.254) and internal intranet subnets.

**Remediation Steps:**

1. Audit Python environments and dependency lockfiles (requirements.txt, poetry.lock, uv.lock) for the presence of the 'mcp' package in versions >= 1.10.0, < 1.30.0 or >= 2.0.0, < 2.2.0.
2. Run 'pip install --upgrade "mcp>=1.30.0,<2.0.0"' for 1.x deployments or 'pip install --upgrade "mcp>=2.2.0"' for 2.x deployments.
3. Verify the installed package version by executing: python -c "import mcp; print(getattr(mcp, '**version** ', 'unknown'))".
4. Ensure existing MCP server tool schemas do not rely on external HTTP/HTTPS $ref resolution, as patched clients will raise a RuntimeError when encountering external schema references.

## 
  
  
  References

*[Read the full report for CVE-2026-116686 on our website](https://cvereports.com/reports/CVE-2026-116686) for more details including interactive diagrams and full exploit analysis.*