Quick answers
- Is CVE-2026-116686 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116686 being exploited in the wild.
- How severe is CVE-2026-116686?
- Medium severity, with a CVSS score of 6.5, published 27 October 2026.
- Which products and versions are affected?
- Anthropic Model Context Protocol Python SDK 1.10.0 through 1.30.0, 2.2.0; mcp (PyPI) >= 2.0.0, < 2.2.0, ECOSYSTEM:introduced=2.0.0,fixed=2.2.0.
- Is there a fix for CVE-2026-116686?
- Yes. mcp (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116686 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116686?
- Check whether you run Anthropic Model Context Protocol Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mcp (PyPI): upgrade to 2.2.0 or later
pip install "mcp>=2.2.0"
Technical details
The SDK's ClientSession, ClientSessionGroup, and Client classes validate outputSchema documents using jsonschema's default resolver without restricting $ref resolution, allowing servers to trigger out-of-band HTTP, HTTPS, or file:// URL fetches from the client context. The resolution runs synchronously on the event loop without timeout, enabling both blind request and local-file-read attacks and potential denial of service by stalling client sessions. The vulnerability affects versions 1.10.0 through 1.30.0 and version 2.2.0; it requires a compromised or malicious Model Context Protocol server.
Affected products
- Anthropic Model Context Protocol Python SDK 1.10.0 through 1.30.0, 2.2.0
Identifiers
- CVE-2026-116686
- GHSA-rwrf-2pqf-9j8j
Timeline
- 2026-10-27: disclosed
- 2026-10-27: patched: versions 1.30.0 and 2.2.0 released