modelcontextprotocol go-sdk vulnerabilities (CVE)

CVE records published for modelcontextprotocol go-sdk, newest first. Follow to get an email when a new one appears.

3 results

7.6High

CVE-2026-34742 7 months ago

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

modelcontextprotocol go-sdk; Red Hat Red Hat OpenShift Dev Spaces 3.28; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Lightspeed

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authenticati…

7.1High

CVE-2026-33252 7 months ago

MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion

modelcontextprotocol go-sdk

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`…

7.0High

CVE-2026-27896 8 months ago

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

modelcontextprotocol go-sdk; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Lightspeed; Red Hat OpenShift Serverless

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would…