DNS Rebinding Vulnerability in Go MCP SDK by Model Context Protocol
CVE-2026-34742

7.6HIGH

Key Information:

Vendor: Modelcontextprotocol
Status: Go-sdk
Vendor: CVE Published:; 2 April 2026

🔔 Create Modelcontextprotocol Vulnerability Alert

What is CVE-2026-34742?

The Go MCP SDK, utilized in HTTP-based server applications, did not implement DNS rebinding protection by default prior to version 1.4.0. This oversight allowed attackers to exploit the vulnerability when the server was running on localhost without proper authentication. By leveraging DNS rebinding exploits, malicious websites could circumvent same-origin policy restrictions and issue unauthorized requests to the local MCP server. Consequently, this gap could enable attackers to access and manipulate resources exposed by the MCP server on behalf of authenticated users. Users are urged to upgrade to version 1.4.0 or later to mitigate this risk.