Skip to content
fr Sign in
7.1 High

CVE-2026-33252 The Go MCP SDK used Go's standard encoding/json

Description

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.

Affected products and versions

Product Affected versions Fixed in
go-sdk 1.4 earliest → < 1.4.1 1.4.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of go-sdk

The 3 CVEs of go-sdk →
CVE-2026-34742 The Go MCP SDK used Go's standard encoding/json 7.6 High CVE-2026-27896 The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions… 7.0 High
Track this CVE