CVE-2026-116686

What it actually does

ClientSession and related classes in the Model Context Protocol Python SDK resolve $ref values in server-provided outputSchema documents using jsonschema's default resolver, enabling synchronous outbound HTTP/HTTPS requests and local filesystem reads without timeouts or sandboxing, which can also block the event loop.

Why it matters to the business

Attackers controlling a server can force clients to make blind network requests or read local files and can cause denial of service by stalling all active sessions; the flaw affects a widely used SDK for AI tool integrations with low but non-zero exploitation probability.

How an attack unfolds

An attacker hosts a malicious Model Context Protocol server that returns an outputSchema containing an unresolved $ref pointing to an attacker-controlled URL or local file path; when a client connects and validates the schema, the resolver synchronously fetches the reference, leaking data or causing resource exhaustion before the fixed versions.

How to fix it

Upgrade the Model Context Protocol Python SDK to version 1.30.0 or 2.2.0 or later; until then, avoid connecting to untrusted servers and consider patching jsonschema usage to use a safe resolver with timeouts and disabled network/file access.

How to confirm the fix worked

Confirm the installed package version is 1.30.0 or 2.2.0 or newer; test by sending a schema containing an external $ref and verifying no outbound requests or file reads occur and that the event loop remains responsive.

Typical attack path

1. Attacker deploys a rogue MCP server advertising a crafted outputSchema with external or file $ref
2. Victim client initiates a session and requests tool definitions
3. Schema validation triggers jsonschema resolver on the event loop
4. Resolver performs blind HTTP/HTTPS request or local file read
5. Session stalls due to synchronous blocking without timeout

How to detect it

Review Python application logs and network telemetry for unexpected outbound HTTP requests or file reads initiated during schema validation in MCP client code; look for synchronous blocking patterns in event-loop threads around schema processing.

What your security team should do

• Immediately inventory all deployments of the Model Context Protocol Python SDK and schedule upgrades to 1.30.0 or 2.2.0
• Block outbound connections from client environments to untrusted MCP servers
• Monitor for unusual file access or network activity originating from Python processes handling MCP sessions