{"id":"ghsa-ghsa-rwrf-2pqf-9j8j","seq":1711760,"kind":"advisory","title":"Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas","url":"https://github.com/advisories/GHSA-rwrf-2pqf-9j8j","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rwrf-2pqf-9j8j","summary":"影響: pip:mcp >= 2.0.0, < 2.2.0 → 2.2.0, pip:mcp >= 1.10.0, < 1.30.0 → 1.30.0\nIn affected versions, when a connected MCP server declared an outputSchema for a tool, the SDK's client validated each call_tool result with jsonschema's default resolver, which fetches any $ref it cannot resolve locally by opening the URL. A server could therefore put an http://, https:// or file:// reference in a tool's output schema and make the client: - request that URL, or read that local file, from the client's own network position on every call of the tool (the content was used only as…","severity":"medium","techs":["python"],"cves":["CVE-2026-116686"],"tags":["GHSA-rwrf-2pqf-9j8j","mcp","mcp"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T21:05:29.000Z","fetched_at":"2026-10-27T21:17:52.472Z"}