#+HashtagPLUS#Hashtag the Web... #Tag your World!
Join

Menu

New post
CVE-2026-116686: CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol…
📰

CVE-2026-116686: CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol…

DEV Community: cybersecurity·CVE Reports·2 days ago
#hne9AQCO
#devtocybersecurity#devto#dev#schema#tool
Reading 0:00
15s threshold

CVE-2026-116686: Server-Side Request Forgery and Synchronous Denial of Service in Model Context Protocol Python SDK

Vulnerability ID: CVE-2026-116686

CVSS Score: 6.5

Published: 2026-10-27

CVE-2026-116686 is a Server-Side Request Forgery (SSRF) and Denial of Service (DoS) vulnerability in the official Model Context Protocol (MCP) Python SDK (mcp package on PyPI). When an MCP client validates structured tool execution results against a server-provided outputSchema, the SDK invokes the Python jsonschema library with its default URI resolution configuration.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Create free accountLog in