CVE-2026-116686: Model Context Protocol Python SDK SSRF and local file read via schema resolution

# CVE-2026-116686: Model Context Protocol Python SDK SSRF and local file read via schema resolution

https://gcdradar.vercel.app/incidents/cve-2026-116686-model-context-protocol-python-sdk-ssrf-and-l · AIR-2026-1587 · closed 2026-10-27

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): CVE advisory with patches and no confirmed exploitation.
- Fix status: Patched
- First reported: 2026-10-27
- AI role: Attack on AI
- Products: Model Context Protocol Python SDK
- CVE ids: CVE-2026-116686
- CVSS: 6.5

## Summary

The Model Context Protocol Python SDK validates server output schemas using a resolver that triggers network requests or local file reads for unresolved references. Malicious servers can exploit this behavior to force blind requests, read local files, and stall client sessions.

## What to do

Update to version 1.30.0 or 2.2.0.

## Affected and fixed versions

- Affected: 1.10.0 to 1.29.x
- Affected: 2.0.0 to 2.1.x
- Fixed in: 1.30.0
- Fixed in: 2.2.0

## Latest updates

- 2026-10-27: GitHub advisory published (https://github.com/advisories/GHSA-rwrf-2pqf-9j8j)
- 2026-10-27: CVE-2026-116686: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. (https://nvd.nist.gov/vuln/detail/CVE-2026-116686)

## Sources

- 2026-10-27 NVD: CVE-2026-116686: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. https://nvd.nist.gov/vuln/detail/CVE-2026-116686
- 2026-10-27 GitHub Advisory Database: CVE-2026-116686: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas https://github.com/advisories/GHSA-rwrf-2pqf-9j8j

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.