{"cve":"CVE-2026-34742","nvd":{"published":"2026-04-02T19:21:33.023","modified":"2026-07-24T21:10:00.143","status":"Modified","description":"The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-1188"],"references":["https://github.com/modelcontextprotocol/go-sdk/commit/67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d","https://github.com/modelcontextprotocol/go-sdk/pull/760","https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0","https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6","https://access.redhat.com/errata/RHSA-2026:21772"],"products":["lfprojects:mcp_go_sdk"],"source":"nvd","synced_at":"2026-10-19T22:28:18.033120106+00:00"},"epss":{"cve":"CVE-2026-34742","score":0.00472,"percentile":0.40862,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xw59-hvm2-8pj6","url":"https://osv.dev/vulnerability/GHSA-xw59-hvm2-8pj6","summary":"DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost","modified":"2026-07-21T15:15:52.149296919Z","packages":[{"ecosystem":"Go","name":"github.com/modelcontextprotocol/go-sdk","purl":"pkg:golang/github.com/modelcontextprotocol/go-sdk","ranges":["<1.4.0"],"fixed":["1.4.0"]}]},{"id":"GO-2026-5771","url":"https://osv.dev/vulnerability/GO-2026-5771","summary":"DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk","modified":"2026-06-25T23:01:17.144844042Z","packages":[{"ecosystem":"Go","name":"github.com/modelcontextprotocol/go-sdk","purl":"pkg:golang/github.com/modelcontextprotocol/go-sdk","ranges":["<1.4.0"],"fixed":["1.4.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}