GHSA-xw59-hvm2-8pj6

Source

https://github.com/advisories/GHSA-xw59-hvm2-8pj6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xw59-hvm2-8pj6/GHSA-xw59-hvm2-8pj6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xw59-hvm2-8pj6

Aliases

CVE-2026-34742

Downstream

MINI-35w4-5mqf-x5vp

MINI-p8vf-7524-pc7x

Published

2026-04-01T21:09:09Z

Modified

2026-04-06T17:46:16.678258Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost

Details

The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.

Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.

Servers created via StreamableHTTPHandler or SSEHandler now have this protection enabled by default when binding to localhost. Users are advised to update to version 1.4.0 to receive this automatic protection.

Database specific

{
    "nvd_published_at": "2026-04-02T19:21:33Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1188"
    ],
    "github_reviewed_at": "2026-04-01T21:09:09Z"
}

References

Affected packages

Go / github.com/modelcontextprotocol/go-sdk

Package

Name: github.com/modelcontextprotocol/go-sdk; View open source insights on deps.dev
Purl: pkg:golang/github.com/modelcontextprotocol/go-sdk

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xw59-hvm2-8pj6/GHSA-xw59-hvm2-8pj6.json"