PT-2026-26466 · Unknown · Go Mcp Sdk

Aleister1102 · Published 2026-03-19 · Updated 2026-05-18 · CVE-2026-33252

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Go MCP SDK versions prior to 1.4.1

Description The Go MCP SDK’s Streamable HTTP transport was susceptible to accepting browser-generated cross-site POST requests without validating the Origin header or requiring Content-Type: application/json. In deployments lacking Authorization, particularly in stateless or sessionless setups, this permitted an arbitrary website to send MCP requests to a local server, potentially triggering tool execution. A malicious website could send cross-site POST requests with Content-Type: text/plain, bypassing CORS preflight barriers due to CORS-safelisted properties. The vulnerable component is the Streamable HTTP transport. The API endpoint is accepting POST requests. The vulnerable parameter is the Origin header.

Recommendations Update to version 1.4.1 or later. Version 1.4.1 requires Go 1.25 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CLEANSTART-2026-LO26058

CVE-2026-33252

GHSA-89XV-2J6F-QHC8

GO-2026-4773

SUSE-SU-2026:1135-1

Affected Products

Go Mcp Sdk

References · 177

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33252.json · Exploit
• https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-89xv-2j6f-qhc8 · Vendor Advisory
• https://github.com/modelcontextprotocol/go-sdk/commit/a433a831d6e5d5ac3b9e625a8095aa8eaa040dfc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33252 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34742 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33762 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25934 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34165 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-LO26058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27896 · Security Note
• https://osv.dev/vulnerability/GO-2026-4773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15558 · Security Note