CVE-2026-116686

MCP Python output schemas can trigger local reads and unbounded network fetches

Model Context Protocol · Python SDK tool-result schema validation

First documented disclosure · Review checkpoint

Summary

Server-selected schema references can make a client fetch URLs or stall every session in its process.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The default JSON Schema resolver opens unresolved HTTP, HTTPS or file references synchronously on the client event loop without a timeout.

Conditions required

A client calls a tool on an untrusted connected MCP server that declares a crafted outputSchema; server-only applications are unaffected.

Potential impact

Blind requests or local-file reads in the client context and denial of service. Retrieved contents are used as schemas and are not returned to the server.

Affected versions and configurations

mcp >=1.10.0, <1.30.0; >=2.0.0, <2.2.0.

Fix and mitigation status

1.30.0 and 2.2.0.

Practical next steps

Upgrade so references resolve only within the supplied schema and bundled metaschemas. Until then, restrict tools to trusted servers; rejecting external schema references is only a partial stopgap.

Operating lesson

Validation must not grant an untrusted schema network or filesystem authority.

Evidence and limits

The public fix PR dates to August 26, the advisory to September 28 and CVE to October 27. The CNA score is 6.5 with user interaction; the maintainer separately rates unattended use 7.5. No exfiltration of fetched file contents is established.

Sources