CVE-2026-27896
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Go MCP SDK prior to version 1.3.1, Go's standard JSON unmarshaler performed case-insensitive matching of JSON keys to struct fields, violating the JSON-RPC 2.0 specification. A malicious MCP peer could send protocol messages with non-standard field casing that the SDK would silently accept, potentially bypassing intermediary inspection and causing cross-implementation inconsistency.
Risk Assessment
The organization is at risk of a malicious MCP peer sending messages with non-standard field casing that the SDK accepts, which could bypass intermediary inspection and cause inconsistencies between implementations, potentially leading to unauthorized actions or data integrity breaches.
Recommendation
Immediately update Go MCP SDK to version 1.3.1, which replaces the standard JSON unmarshaler with a case-sensitive decoder to fix this issue.
Other vulnerabilities in Go MCP SDK
See all- CVE-2026-33252High
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution.
- CVE-2026-34742High
The Go MCP SDK prior to version 1.4.0 does not enable DNS rebinding protection by default for HTTP-based servers. When an MCP server runs on localhost without authentication using StreamableHTTPHandler or SSEHandler, a malicious website can exploit DNS rebinding to bypass same-origin policy and send requests to the local MCP server, potentially invoking tools or accessing resources.
Original NVD description (English source)
The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS