Server Misconfiguration in mcp-go Affects Loopback Connections
CVE-2026-81092

7.6HIGH

Key Information:

Vendor

Mark3labs

Status
Mcp-go
Vendor
CVE Published:
27 August 2026

What is CVE-2026-81092?

The mcp-go server software fails to verify the Host header for requests arriving over its HTTP transports. This oversight allows potentially dangerous requests from a controlled browser page that point to the loopback address to access server resources as if they were local. Prior to version 0.56.0, both the StreamableHTTPServer and SSEServer did not validate incoming requests, leading to possible exploitation through techniques like DNS rebinding. Version 0.56.0 introduces crucial Host header validation that mitigates this risk by rejecting inappropriate loopback requests.

Affected Version(s)

mcp-go 0 < 0.56.0

References

https://github.com/mark3labs/mcp-go
product
https://github.com/mark3labs/mcp-go/pull/921
issue-trackingpatch
https://github.com/mark3labs/mcp-go/releases/tag/v0.56.0
release-notes

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Avishai Gonen (Pluto Security)
.