CVE-2026-116686: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

In affected versions, when a connected MCP server declared an outputSchema for a tool, the SDK’s client validated each call_tool result with jsonschema’s default resolver, which fetches any $ref it cannot resolve locally by opening the URL. A server could therefore put an http://, https:// or file:// reference in a tool’s output schema and make the client:

• request that URL, or read that local file, from the client’s own network position on every call of the tool (the content was used only as a schema and never sent back to the server), and
• stall: the fetch ran synchronously on the event loop with no timeout, so a target that accepted the connection and then went quiet froze every session in the process for as long as it held the connection.