CVE-2026-27896

HighCVSS 7.5

Published: 26/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

In Go MCP SDK prior to version 1.3.1, Go's standard JSON unmarshaler performed case-insensitive matching of JSON keys to struct fields, violating the JSON-RPC 2.0 specification. A malicious MCP peer could send protocol messages with non-standard field casing that the SDK would silently accept, potentially bypassing intermediary inspection and causing cross-implementation inconsistency.

Risk Assessment

The organization is at risk of a malicious MCP peer sending messages with non-standard field casing that the SDK accepts, which could bypass intermediary inspection and cause inconsistencies between implementations, potentially leading to unauthorized actions or data integrity breaches.

Recommendation

Immediately update Go MCP SDK to version 1.3.1, which replaces the standard JSON unmarshaler with a case-sensitive decoder to fix this issue.

Other vulnerabilities in Go MCP SDK

CVE-2026-34742High
The Go MCP SDK prior to version 1.4.0 does not enable DNS rebinding protection by default for HTTP-based servers. When an MCP server runs on localhost without authentication using StreamableHTTPHandler or SSEHandler, a malicious website can exploit DNS rebinding to bypass same-origin policy and send requests to the local MCP server, potentially invoking tools or accessing resources.

Original NVD description (English source)

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.