CVE-2026-33252
HighCVSS 7.1Summary
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution.
Risk Assessment
An attacker could leverage a victim's browser to send unauthorized requests to a local MCP server, potentially leading to tool execution and unwanted actions. The risk particularly affects deployments without authorization and stateless configurations.
Recommendation
Update the Go MCP SDK to version 1.4.1 or later. In the meantime, implement authorization and Origin header validation, and require Content-Type: application/json for MCP requests.
Other vulnerabilities in Go MCP SDK
See all- CVE-2026-34742High
The Go MCP SDK prior to version 1.4.0 does not enable DNS rebinding protection by default for HTTP-based servers. When an MCP server runs on localhost without authentication using StreamableHTTPHandler or SSEHandler, a malicious website can exploit DNS rebinding to bypass same-origin policy and send requests to the local MCP server, potentially invoking tools or accessing resources.
- CVE-2026-27896High
In Go MCP SDK prior to version 1.3.1, Go's standard JSON unmarshaler performed case-insensitive matching of JSON keys to struct fields, violating the JSON-RPC 2.0 specification. A malicious MCP peer could send protocol messages with non-standard field casing that the SDK would silently accept, potentially bypassing intermediary inspection and causing cross-implementation inconsistency.
Original NVD description (English source)
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS