Threats tagged 'brew-mcp-proxy-cve-2026-116686'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.5	CVE-2026-116686mcp-proxy · Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output Medium6.52026-10-29GCVE DatabaseCVE-2026-116686 The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-declared external $ref URLs during tool output schema validation. This can cause the client to synchronously fetch arbitrary HTTP, HTTPS, or file URLs from the client's network position, potentially stalling the client if the target is unresponsive. The issue affects applications using the SDK as a client calling tools on untrusted servers. Fixed in versions 1.30.0 and 2.2.0. Report on CVE-2026-116686 Vulnerability #brew-mcp-proxy-cve-2026-116686 #homebrew	GCVE Database	2026-10-29

Page 1 of 1