modelcontextprotocol go-sdk Schwachstellen (CVE)

Für modelcontextprotocol go-sdk veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

3 Ergebnisse

7.6Hoch

CVE-2026-34742 vor 7 Monaten

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

modelcontextprotocol go-sdk; Red Hat Red Hat OpenShift Dev Spaces 3.28; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Lightspeed

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authenticati…

7.1Hoch

CVE-2026-33252 vor 7 Monaten

MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion

modelcontextprotocol go-sdk

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`…

7.0Hoch

CVE-2026-27896 vor 8 Monaten

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

modelcontextprotocol go-sdk; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Lightspeed; Red Hat OpenShift Serverless

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would…