CVE-2026-116685

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

CVE-2026-116686

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

EUVD-2026-111366

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116686

The Model Context Protocol Python SDK contains a vulnerability in versions 1.10.0 through 1.30.0 and 2.2.0 . The ClientSession, ClientSessionGroup, and Client tool calls use the default resolver in jsonschema to validate server-declared outputSchema documents. This allows a server to provide an u...

EUVD-2026-111367

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...