Threats tagged 'brew-fastmcp-cve-2026-116686'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.3%	CVE-2026-116686fastmcp · Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output Medium6.5EPSS 0.3%2026-10-29GCVE DatabaseCVE-2026-116686 The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches external URLs or local files referenced in a tool's output schema during validation. This can cause the client to make network or file system requests synchronously without timeout, potentially freezing the client session if the target is unresponsive. The issue affects clients calling tools on MCP servers they do not fully control. Fixed in versions 1.30.0 (1.x) and 2.2.0 (2.x) and later. EPSS 0.3%Report on CVE-2026-116686 Vulnerability #brew-fastmcp-cve-2026-116686 #homebrew	GCVE Database	2026-10-29

Page 1 of 1