CVE-2026-116686: CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol…

A server-side request forgery and synchronous denial-of-service vulnerability, tracked as CVE-2026-116686, affects the official Model Context Protocol Python SDK (the mcp package on PyPI) in versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1. When a client validates tool results against a server-supplied outputSchema, the SDK passes external $ref directives to the jsonschema library with default URI resolution, letting a malicious MCP server trigger blind SSRF, probe local files via file://, or freeze the client's event loop with synchronous requests. The flaw is fixed in mcp 1.30.0 and 2.2.0, which restrict schema resolution to in-document references.

CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol Python SDK Vulnerability ID: CVE-2026-116686 CVSS Score: 6.5 Published: 2026-10-27 CVE-2026-116686 is a Server-Side Request Forgery SSRF and Denial of Service DoS vulnerability in the official Model Context Protocol MCP Python SDK mcp package on PyPI . When an MCP client validates structured tool execution results against a server-provided outputSchema, the SDK invokes the Python jsonschema library with its default URI resolution configuration. An untrusted or compromised MCP server can supply an outputSchema containing external $ref directives using http://, https://, or file:// schemes , forcing the client process to synchronously fetch internal network resources, read local files, or block the main event loop indefinitely. TL;DR The Model Context Protocol MCP Python SDK versions 1.10.0 to 1.29.1 and 2.0.0 to 2.1.1 resolves external $ref URIs when validating tool results against server-supplied output schemas. Connecting to a malicious MCP server and calling a tool allows the server to trigger blind SSRF, probe local files, or freeze the client application's asynchronous event loop via synchronous network requests without timeouts. Upgrade to mcp 1.30.0 or 2.2.0 to restrict schema resolution to in-document references. ⚠️ Exploit Status: POC Technical Details - Vulnerability Type : CWE-918: Server-Side Request Forgery SSRF & Synchronous Event-Loop DoS - CVSS v3.1 Score : 6.5 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Affected Package : mcp PyPI = 1.10.0, < 1.30.0 and = 2.0.0, < 2.2.0 - Patched Versions : mcp 1.30.0 v1.x and mcp 2.2.0 v2.x - Affected Component : src/mcp/client/session.py validate tool result / validate tool result - Attack Vector : Network Untrusted MCP Server returning crafted Tool.outputSchema - Primary Impact : Blind SSRF, Local File Probing file:// , Process-wide Event Loop Freezing - CISA KEV Status : Not Listed Affected Systems - Model Context Protocol Python SDK PyPI: mcp = 1.10.0, < 1.30.0 - Model Context Protocol Python SDK PyPI: mcp = 2.0.0, < 2.2.0 - mcp Model Context Protocol Python SDK : = 1.10.0, < 1.30.0 Fixed in: 1.30.0 - mcp Model Context Protocol Python SDK : = 2.0.0, < 2.2.0 Fixed in: 2.2.0 Code Analysis Resolve tool output-schema references within the schema document only 3394 v1.x Resolve tool output-schema references within the schema document only 3396 Mitigation Strategies - Upgrade the mcp Python SDK to version 1.30.0 for 1.x environments or 2.2.0 for 2.x environments to enforce isolated in-memory JSON Schema reference resolution. - Restrict MCP client connections exclusively to vetted, trusted MCP servers until the SDK upgrade is deployed. - Implement client-side schema sanitization middleware to inspect Tool.outputSchema definitions and block any tool containing $id attributes or non-fragment $ref / $dynamicRef URIs URIs not starting with ' ' . - Apply network egress filtering on hosts running MCP clients to block unauthorized connections to link-local cloud metadata services 169.254.169.254 and internal intranet subnets. Remediation Steps: 1. Audit Python environments and dependency lockfiles requirements.txt, poetry.lock, uv.lock for the presence of the 'mcp' package in versions = 1.10.0, < 1.30.0 or = 2.0.0, < 2.2.0. 2. Run 'pip install --upgrade "mcp =1.30.0,<2.0.0"' for 1.x deployments or 'pip install --upgrade "mcp =2.2.0"' for 2.x deployments. 3. Verify the installed package version by executing: python -c "import mcp; print getattr mcp, ' version ', 'unknown' ". 4. Ensure existing MCP server tool schemas do not rely on external HTTP/HTTPS $ref resolution, as patched clients will raise a RuntimeError when encountering external schema references. References Read the full report for CVE-2026-116686 on our website https://cvereports.com/reports/CVE-2026-116686 for more details including interactive diagrams and full exploit analysis.