PT-2026-26466 · Unknown · Go Mcp Sdk

Aleister1102 · Publicado 2026-03-19 · Atualizado 2026-05-18 · CVE-2026-33252

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Go MCP SDK versions prior to 1.4.1

Description The Go MCP SDK’s Streamable HTTP transport was susceptible to accepting browser-generated cross-site POST requests without validating the Origin header or requiring Content-Type: application/json. In deployments lacking Authorization, particularly in stateless or sessionless setups, this permitted an arbitrary website to send MCP requests to a local server, potentially triggering tool execution. A malicious website could send cross-site POST requests with Content-Type: text/plain, bypassing CORS preflight barriers due to CORS-safelisted properties. The vulnerable component is the Streamable HTTP transport. The API endpoint is accepting POST requests. The vulnerable parameter is the Origin header.

Recommendations Update to version 1.4.1 or later. Version 1.4.1 requires Go 1.25 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CLEANSTART-2026-LO26058

CVE-2026-33252

GHSA-89XV-2J6F-QHC8

GO-2026-4773

SUSE-SU-2026:1135-1

Produtos afetados

Go Mcp Sdk

Referências · 177

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33252.json · Exploit
• https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-89xv-2j6f-qhc8 · Aviso do Fabricante
• https://github.com/modelcontextprotocol/go-sdk/commit/a433a831d6e5d5ac3b9e625a8095aa8eaa040dfc · Correção
• https://github.com/modelcontextprotocol/go-sdk · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LO26058.json · Nota
• https://suse.com/security/cve/CVE-2026-22545 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33252 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-33281 · Nota
• https://suse.com/security/cve/CVE-2026-33132 · Nota
• https://suse.com/security/cve/CVE-2026-33191 · Nota
• https://suse.com/security/cve/CVE-2026-33066 · Nota
• https://suse.com/security/cve/CVE-2026-33315 · Nota
• https://suse.com/security/cve/CVE-2026-33247 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34742 · Nota de Segurança