PT-2026-22069 · Unknown · Go Mcp Sdk

Anaximand3R · Published 2026-02-26 · Updated 2026-05-18 · CVE-2026-27896

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Go MCP SDK versions prior to 1.3.1

Description The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing. Go's standard library performs case-insensitive matching of JSON keys to struct field tags, meaning a field tagged json:"method" would also match "Method", "METHOD", etc. It also folds Unicode characters to their ASCII equivalents, such as 'ſ' (U+017F) to 's' and 'K' (U+212A) to 'k'. This behavior violates the JSON-RPC 2.0 specification, which requires exact field names. A malicious MCP peer could send protocol messages with non-standard field casing that the SDK would silently accept, potentially bypassing intermediary inspection and causing cross-implementation inconsistencies. This issue affects the parsing of JSON-RPC and MCP protocol messages.

Recommendations Update the Go MCP SDK to version 1.3.1 to resolve this issue.

Exploit

Fix

Weakness Enumeration

CWE-178

CWE-436

Related Identifiers

BDU:2026-02402

CLEANSTART-2026-LO26058

CVE-2026-27896

GHSA-WVJ2-96WP-FQ3F

GO-2026-4569

SUSE-SU-2026:1042-1

Affected Products

Go Mcp Sdk

References · 170

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27896.json · Exploit
• 🔥 https://github.com/huseyinstif/CVE-2026-2441-PoC · Exploit
• https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0 · Patch
• https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34742 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33762 · Security Note
• https://osv.dev/vulnerability/GHSA-wvj2-96wp-fq3f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25934 · Security Note
• https://osv.dev/vulnerability/GO-2026-4569 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34165 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-LO26058 · Vendor Advisory