Python SDK for Model Context Protocol fetches server-chosen $ref URLs
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
The Model Context Protocol Python SDK from 1.10.0 before 1.30.0 and from 2.0.0 before 2.2.0 validates tool results against server-declared output schemas with the default resolver. An unresolved $ref value makes the client fetch HTTP, HTTPS or file URLs from its own network and filesystem context, which is server-side request forgery (CWE-918). A malicious server can trigger blind requests or local file reads, and the synchronous resolution without a timeout can stall every session in the process.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | python-sdk | 1.10.0 to before 1.30.0; 2.0.0 to before 2.2.0 | 1.30.0, 2.2.0 | Patch available | CNA |
| — | mcp (PyPI) | 2.0.0 to before 2.2.0 | 2.2.0 | Patch available | GHSA-rwrf-2pqf-9j8j |
| — | mcp (PyPI) | 1.10.0 to before 1.30.0 | 1.30.0 | Patch available | GHSA-rwrf-2pqf-9j8j |
- python-sdk VendorMLflow Affected 1.10.0 to before 1.30.0; 2.0.0 to before 2.2.0 Fixed in 1.30.0, 2.2.0 Patch available CNA
- mcp (PyPI) Vendor— Affected 2.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-rwrf-2pqf-9j8j
- mcp (PyPI) Vendor— Affected 1.10.0 to before 1.30.0 Fixed in 1.30.0 Patch available GHSA-rwrf-2pqf-9j8j
Remediation
Upgrade the mcp package on the 1.x line to 1.30.0 and on the 2.x line to 2.2.0, as fixed in the python-sdk releases. Red Hat lists no fix planned for Exploit Intelligence and no available fix for Ansible Automation Orchestrator 2026, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA python-sdk (modelcontextprotocol) Fixed in 1.30.0, 2.2.0
- Fix · GHSA-rwrf-2pqf-9j8j mcp (PyPI) Fixed in 2.2.0 Advisory →
- Fix · GHSA-rwrf-2pqf-9j8j mcp (PyPI) Fixed in 1.30.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet: Fix deferred |
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux command line assistant | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-27 Threatist record created from CVE-2026-116686
- 2026-10-27 Alias added: GHSA-rwrf-2pqf-9j8j
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
References
Other 8
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j
- https://github.com/modelcontextprotocol/python-sdk/pull/3394
- https://github.com/modelcontextprotocol/python-sdk/pull/3396
- https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836
- https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
- https://github.com/modelcontextprotocol/python-sdk
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-116686 · CVE Program
- CVE-2026-116686 · NVD
- FIRST EPSS
- GHSA-rwrf-2pqf-9j8j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116686 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences