GHSA-xw59-hvm2-8pj6 CVE-2026-34742 GO-2026-5771
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost
- Severity
- 7.6 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.47%
- Chance of exploitation in the next 30 days. Higher than 40.86% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1188 Initialization of a Resource with an Insecure Default
- Fix
1.4.0- Upgrade github.com/modelcontextprotocol/go-sdk to this version or later
Description
The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.
Servers created via StreamableHTTPHandler or SSEHandler now have this protection enabled by default when binding to localhost. Users are advised to update to version 1.4.0 to receive this automatic protection.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/modelcontextprotocol/go-sdk | < 1.4.0 |
1.4.0 |
| github.com/modelcontextprotocol/go-sdk | < 1.4.0 |
1.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/modelcontextprotocol/go-sdk Go → 1.4.0
- go
go get github.com/modelcontextprotocol/go-sdk@v1.4.0 && go mod tidy
Severity breakdown
CVSS 4.0 7.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-89xv-2j6f-qhc8 Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk | Medium | Also affects github.com/modelcontextprotocol/go-sdk |
| GHSA-q382-vc8q-7jhj Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk | High | Also affects github.com/modelcontextprotocol/go-sdk |
| GHSA-wvj2-96wp-fq3f MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity | High | Also affects github.com/modelcontextprotocol/go-sdk |
| GHSA-9qh4-3jw8-366w Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions | Critical | Same weakness, CWE-1188 |
| GHSA-jxxv-8r27-vm4p vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts | Critical | Same weakness, CWE-1188 |
| GHSA-p3m8-78j2-g5p3 NLTK: Default ENFORCE=False Disables All pathsec Security Controls | High | Same weakness, CWE-1188 |
| GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical | Same weakness, CWE-1188 |
| GHSA-jr9p-4h4j-6c58 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover | Critical | Same weakness, CWE-1188 |
Credits: JLLeitschuh
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor