The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` req…

Published:

23 maart 2026 om 23:00:00

Alert date:

24 maart 2026 om 09:16:39

Source:

nvd.nist.gov

Web Technologies, Supply Chain & Dependencies

The Go MCP SDK prior to version 1.4.1 had a cross-site request forgery vulnerability in its Streamable HTTP transport. The vulnerability allowed browser-generated cross-site POST requests without proper validation of Origin headers or Content-Type requirements. This affected deployments without authorization, particularly stateless or sessionless configurations, allowing arbitrary websites to send MCP requests to local servers and potentially trigger tool execution. The issue has been patched in version 1.4.1.

Technical details

Mitigation steps:

Affected products:

Go MCP SDK