{"data":{"id":"daa2dc79-a250-45f4-ab73-f43b025faf60","title":"GHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas","summary":"The Model Context Protocol Python SDK's client validated tool results against server-declared outputSchema using jsonschema's default resolver, which fetched any unresolved $ref by opening the URL. A malicious server could make the client request http, https or file URLs from its own network position on every call, and because the fetch ran synchronously with no timeout, a target that stalled would freeze all sessions in the process. Affected versions are 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1, for applications that use the SDK as a client.","solution":"Fixed in mcp 1.30.0 (1.x) and 2.2.0 (2.x). The client now resolves references only within the server-sent schema document plus the standard JSON Schema metaschemas. Until upgrading, call tools only on trusted servers. As a partial stopgap, skip tools whose outputSchema contains an $id, or a $ref or $dynamicRef that does not start with #.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-rwrf-2pqf-9j8j","publishedAt":"2026-10-27T21:05:29.000Z","cveId":"CVE-2026-116686","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mcp@>= 1.10.0, < 1.30.0 (fixed: 1.30.0)","mcp@>= 2.0.0, < 2.2.0 (fixed: 2.2.0)"],"affectedPackageNames":["mcp"],"affectedPackageRefs":["pypi:mcp"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Model Context Protocol Python SDK","MCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-28T00:05:48.682Z","kevDateAdded":null,"advisoryAliases":["GHSA-rwrf-2pqf-9j8j"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-27T21:05:29.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}