Threats tagged 'ghsa-rwrf-2pqf-9j8j'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.5	CVE-2026-116686mcp · Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output Medium6.52026-10-27GCVE DatabaseCVE-2026-116686 The Model Context Protocol (MCP) Python SDK versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 contain a vulnerability where the client fetches server-chosen $ref URLs during tool result validation. This allows a malicious server to cause the client to make network or local file requests synchronously without timeout, potentially freezing the client session. The issue is fixed in versions 1.30.0 and 2.2.0. Report on CVE-2026-116686 Vulnerability CWE-918 #ghsa-rwrf-2pqf-9j8j #pypi	GCVE Database	2026-10-27

Page 1 of 1