Cross-Site Request Forgery in Go MCP SDK from Model Context Protocol
CVE-2026-33252

7.1HIGH

Key Information:

Vendor

Modelcontextprotocol

Status
Go-sdk
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33252?

The Go MCP SDK has a vulnerability in its Streamable HTTP transport prior to version 1.4.1, allowing unauthorized cross-origin POST requests without proper validation of the Origin header or the Content-Type requirement. This lack of validation can lead to malicious websites sending requests that trigger unintended actions on local servers, particularly in configurations that do not require authorization. The issue has been addressed in version 1.4.1 to enhance security and prevent such exploitation.

Affected Version(s)

go-sdk < 1.4.1

References

https://github.com/modelcontextprotocol/go-sdk/security/a...
x_refsource_CONFIRM
https://github.com/modelcontextprotocol/go-sdk/commit/a43...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.