Skip to content
OpenAdvisories

Product · mark3labs

mcp-go

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-81092

    mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

    mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the hos…

    mark3labs mcp-go