An untrusted MCP server includes an external $ref in a tool outputSchema. The client uses a default resolver that follows the reference during call_tool validation, sending a request from the client’s network or reading a local path. CVE-2026-116686 identifies http, https and file external references fetched by the Python MCP client during schema…
Inspect the ClaimsCase · DiggingBeagle record
MCP output-schema validation could make the client fetch server-selected URLs and files
A tool description’s JSON Schema external reference became a network and local-file read in an MCP client rather than a confined schema validation.
Scope
Only client applications that call tools on untrusted MCP servers are within the described attack path. The report does not establish that local file content was exfiltrated.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
A connected server can declare external outputSchema references that the affected MCP client resolves with file or HTTP access, potentially blocking the event loop. The advisory says schema content was not automatically transmitted back to the server. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-028-A · CLM-CP22-028-B · CLM-ENRICH-20261028-011 · MCP Python SDK external output-schema reference retrieval advisory
At a glance
Additional exfiltration would require another channel and was not demonstrated merely by loading a schema reference.
Limits and uncertaintyFull account
An untrusted MCP server includes an external $ref in a tool outputSchema. The client uses a default resolver that follows the reference during call_tool validation, sending a request from the client’s network or reading a local path.
CVE-2026-116686 identifies http, https and file external references fetched by the Python MCP client during schema validation. The advisory states the read schema data was used for validation rather than automatically returned to the server; a hanging reference could still block the event loop without a timeout. Primary evidence.
Only client applications that call tools on untrusted MCP servers are within the described attack path. The report does not establish that local file content was exfiltrated.
Upgrade to MCP Python SDK 1.30.0 or 2.2.0 or later and forbid schema resolution outside the received document, including file and network schemes.
Claims & evidence
CLM-CP22-028-ACVE-2026-116686 identifies http, https and file external references fetched by the Python MCP client during schema validation.supported
Basis: reported finding
- supportsMCP Python SDK external output-schema reference retrieval advisoryprimary disclosure
Advisory summary; default JSON Schema resolver
CLM-CP22-028-BThe advisory states the read schema data was used for validation rather than automatically returned to the server; a hanging reference could still block the event loop without a timeout.supported
Basis: reported finding
- supportsMCP Python SDK external output-schema reference retrieval advisoryprimary disclosure
Advisory; consequence and client scope
CLM-ENRICH-20261028-011An external output-schema reference could synchronously stall the MCP client event loop without a timeout, but the fetched schema bytes were used for validation rather than automatically sent back to the server.supported
Basis: reported finding
- supportsMCP Python SDK external output-schema reference retrieval advisoryprimary disclosure
Summary and Am I affected?, GHSA-rwrf-2pqf-9j8j
Controls and mitigations
- Upgrade to MCP Python SDK 1.30.0 or 2.2.0 or later and forbid schema resolution outside the received document, including file and network schemes.
Unknowns and contradictions
- Additional exfiltration would require another channel and was not demonstrated merely by loading a schema reference.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199