The Go MCP SDK prior to version 1.4.1 had a cross-site request forgery vulnerability in its Streamable HTTP transport. The vulnerability allowed browser-generated cross-site POST requests without proper validation of Origin headers or Content-Type requirements. This affected deployments without authorization, particularly stateless or sessionless configurations, allowing arbitrary websites to send MCP requests to local servers and potentially trigger tool execution. The issue has been patched in version 1.4.1.