Multiple security vulnerabilities have been identified in the Model Context Protocol Python SDK, affecting client and server components in version ranges 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, with some issues beginning at 1.10.0. The flaws can expose credentials, cause denial of service, or allow token misuse. Overall risk is moderate for applications that use the SDK as a client or server with untrusted or multi-service authentication.
CVE-2026-116686 (CVSS 6.5 — Medium): The client-side tool result validation component could fetch server-chosen reference URLs when validating output schemas. A malicious or compromised server could use this to make the client request network resources, read local files, and stall sessions through synchronous fetching without a timeout.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Model Context Protocol Python SDK, affecting client and server components in version ranges 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, with some issues beginning at 1.10.0. The flaws can expose credentials, cause denial of service, or allow token misuse. Overall risk is moderate for applications that use the SDK as a client or server with untrusted or multi-service authentication.
CVE-2026-116686 (CVSS 6.5 — Medium): The client-side tool result validation component could fetch server-chosen reference URLs when validating output schemas. A malicious or compromised server could use this to make the client request network resources, read local files, and stall sessions through synchronous fetching without a timeout.[emaillocker id="1283"]
CVE-2026-116685 (CVSS 5.9 — Medium): The HTTP client transports and related OAuth request flows could follow cross-origin redirects while retaining custom headers and, for certain redirect types, request bodies. An attacker who could influence a trusted endpoint's redirect could capture those credentials or request data at the redirect target.
CVE-2026-116684 (CVSS 6.8 — Medium): The server-side bearer-token authentication component did not verify that a presented token was issued for the intended resource server. An attacker holding a valid token for another service could use it to access the affected server when the authorization server issued tokens for multiple services.
These vulnerabilities collectively present a moderate risk to applications that rely on the SDK for client communication or server authentication. The greatest exposure is for deployments that connect to untrusted servers, use HTTP endpoints with redirects, or share authorization servers across multiple services. Organizations should prioritize review and update of affected SDK deployments.
We recommend you to update mcp to version 1.30.0 or 2.2.0 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]