# CVE-2026-116686: Model Context Protocol Python SDK unvalidated $ref fetching

Source: https://junglewise.ai/threats/cve-2026-116686-the-model-context-protocol-python-sdk-is-the-official-python-sdk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116686 · Severity: medium · CVSS 6.5 · Published 2026-10-27

The Model Context Protocol Python SDK, used to build AI assistant servers and clients, improperly validates JSON schema documents sent by servers. An attacker controlling a server can trick client applications into making unauthorized HTTP/HTTPS requests to arbitrary URLs or reading files from the client's filesystem. This could expose sensitive data or enable further network attacks from compromised client systems.

Technologies: [Anthropic Model Context Protocol Python SDK](https://junglewise.ai/threats/technologies/anthropic-model-context-protocol-python-sdk), [mcp (PyPI)](https://junglewise.ai/threats/technologies/pypi-mcp). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116686 being exploited in the wild.

**How severe is CVE-2026-116686?** Medium severity, with a CVSS score of 6.5, published 27 October 2026.

**Which products and versions are affected?** Anthropic Model Context Protocol Python SDK 1.10.0 through 1.30.0, 2.2.0; mcp (PyPI) >= 2.0.0, < 2.2.0, ECOSYSTEM:introduced=2.0.0,fixed=2.2.0.

**Is there a fix for CVE-2026-116686?** Yes. mcp (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116686 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116686?** Check whether you run Anthropic Model Context Protocol Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mcp (PyPI): upgrade to 2.2.0 or later

  ```sh
  pip install "mcp>=2.2.0"
  ```


## Technical details

The SDK's ClientSession, ClientSessionGroup, and Client classes validate outputSchema documents using jsonschema's default resolver without restricting $ref resolution, allowing servers to trigger out-of-band HTTP, HTTPS, or file:// URL fetches from the client context. The resolution runs synchronously on the event loop without timeout, enabling both blind request and local-file-read attacks and potential denial of service by stalling client sessions. The vulnerability affects versions 1.10.0 through 1.30.0 and version 2.2.0; it requires a compromised or malicious Model Context Protocol server.

## Affected products

- Anthropic Model Context Protocol Python SDK 1.10.0 through 1.30.0, 2.2.0

## Identifiers

- CVE-2026-116686
- GHSA-rwrf-2pqf-9j8j

## Timeline

- 2026-10-27: disclosed
- 2026-10-27: patched: versions 1.30.0 and 2.2.0 released

## References

- [https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836](https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836)
- [https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b](https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b)

## Related threats

- [Model Context Protocol Python SDK credential and body leak on cross-origin redirects](https://junglewise.ai/threats/cve-2026-116685-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [Model Context Protocol Python SDK token resource confusion in bearer authentication](https://junglewise.ai/threats/cve-2026-116684-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [MCP Python SDK unbounded session accumulation in StreamableHTTP](https://junglewise.ai/threats/cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in-streamablehttp)
- [modelcontextprotocol python-sdk missing origin validation in WebSocket transport](https://junglewise.ai/threats/cve-2026-59950-modelcontextprotocol-python-sdk-missing-origin-validation-in)
- [Model Context Protocol Python SDK missing authorization in experimental tasks](https://junglewise.ai/threats/cve-2026-52870-model-context-protocol-python-sdk-missing-authorization-in)