MCP Python SDK flaw enables SSRF and event-loop DoS via outputSchema

CVE-2026-116686 (CVSS 6.5) in the official MCP Python SDK lets a malicious server use external $ref directives in outputSchema to trigger blind SSRF, probe local files and freeze the client's event loop. Versions 1.10.0–1.29.1 and 2.0.0–2.1.1 are affected; fixes ship in 1.30.0 and 2.2.0.

• CVSS 6.5: blind SSRF, file:// probing and synchronous event-loop blocking
• Affects mcp 1.10.0–1.29.1 and 2.0.0–2.1.1; patched in 1.30.0 and 2.2.0
• Fix restricts $ref resolution to within the schema document
• Public PoC exists; not listed in CISA KEV