CVE-2026-33252highCWE-352

CVE-2026-33252: falha de alta gravidade em modelcontextprotocol go-sdk

MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar go-sdk+ Monitorar github.com/modelcontextprotocol/go-sdk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.2%
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Produtos afetados
modelcontextprotocol · go-sdk
CVEs relacionadas — modelcontextprotocol go-sdk

No mesmo produto, das mais perigosas para as menos.

CVE-2026-34742HIGHModel Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on LocalhostEPSS 0.5%CVE-2026-27896HIGHMCP Go SDK Vulnerable to Improper Handling of Case SensitivityEPSS 0.3%