7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33252

CVE-2026-33252: MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33252

CVE-2026-33252:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/modelcontextprotocol/go-sdk	go	<= 1.4.0	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a cross-site request forgery (CSRF) issue in the github.com/modelcontextprotocol/go-sdk. The root cause is the failure of the HTTP server to validate the Origin and Content-Type headers of incoming requests. This allows a malicious website to make unauthorized POST requests to a local server running the vulnerable SDK.

The analysis of the provided commit a433a831d6e5d5ac3b9e625a8095aa8eaa040dfc reveals that the core changes were made in the mcp/streamable.go file. Specifically, the (*StreamableHTTPHandler).ServeHTTP function was modified to include validation for both the Origin and Content-Type headers.

Before the fix, this function would process any POST request regardless of its origin or content type. An attacker could craft a simple HTML form on a malicious website that sends a POST request with Content-Type: text/plain to the local MCP server. Because this is a CORS-safelisted request, the browser would send it without a preflight OPTIONS request, and the vulnerable server would accept and process it.

The patch introduces explicit checks. It uses h.opts.CrossOriginProtection.Check(req) to validate the Origin header and then checks if the Content-Type header is exactly application/json for POST requests. If either of these checks fails, the request is rejected with an appropriate HTTP error status.

Therefore, the function (*StreamableHTTPHandler).ServeHTTP is the exact location of the vulnerability. During an exploit, this function would be present in the call stack as it's the primary handler for processing the malicious incoming HTTP request.

Vulnerable functions

(*StreamableHTTPHandler).ServeHTTP

mcp/streamable.go

The `ServeHTTP` function of the `StreamableHTTPHandler` is responsible for handling incoming HTTP requests. Prior to the patch, this function did not validate the 'Origin' and 'Content-Type' headers. This allowed malicious websites to send cross-site POST requests with a non-JSON content type (e.g., 'text/plain'), bypassing CORS preflight checks and potentially executing arbitrary commands on the server. The patch adds checks to ensure the 'Origin' is trusted and the 'Content-Type' is 'application/json' for POST requests, thus mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.