CVE-2026-34742HIGH 8.1EPSS p33.5%

CVE-2026-34742CVE-2026-34742

Description

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.

Scoring

CVSS 3.18.1 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS0.42% probability of exploitation · percentile 33.5% · 2026-06-18T12:00:27Z
Published2026-04-02
Last modified2026-04-03

Underlying weaknesses· 1

CWE-1188

References

  1. https://github.com/modelcontextprotocol/go-sdk/commit/67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d
  2. https://github.com/modelcontextprotocol/go-sdk/pull/760
  3. https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0
  4. https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6

1

TypeTargetConfidenceTier
WeaknessInitialization of a Resource with an Insecure Defaultcwe-11880%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-66416
CVE
CVE-2025-66414
CVE
CVE-2025-64443
CVE
CVE-2026-34237
CVE
CVE-2026-35577
CVE
CVE-2026-42559
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.