CVE-2026-34742

HighCVSS 8.1

Published: 02/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

37th percentile - higher than 37% of all known CVEs

Summary

The Go MCP SDK prior to version 1.4.0 does not enable DNS rebinding protection by default for HTTP-based servers. When an MCP server runs on localhost without authentication using StreamableHTTPHandler or SSEHandler, a malicious website can exploit DNS rebinding to bypass same-origin policy and send requests to the local MCP server, potentially invoking tools or accessing resources.

Risk Assessment

An attacker can remotely invoke tools or access resources on the MCP server on behalf of the user, potentially leading to unauthorized actions or data leakage.

Recommendation

Upgrade the Go MCP SDK to version 1.4.0, which contains the fix. As a temporary measure, enable authentication for MCP servers or restrict access to trusted clients.

Other vulnerabilities in Go MCP SDK

CVE-2026-27896High
In Go MCP SDK prior to version 1.3.1, Go's standard JSON unmarshaler performed case-insensitive matching of JSON keys to struct fields, violating the JSON-RPC 2.0 specification. A malicious MCP peer could send protocol messages with non-standard field casing that the SDK would silently accept, potentially bypassing intermediary inspection and causing cross-implementation inconsistency.

Original NVD description (English source)

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.