vulnerability · mcp

MCP Go HTTP servers can accept cross-site requests that trigger tools

A malicious website can send cross-site requests to an MCP Go server lacking authorization, potentially invoking tools with the server's authority.

high severityconfirmed confidencepatchedNo known exploitation

Quick answer

What defenders need to know

What is it?: A malicious website can send cross-site requests to an MCP Go server lacking authorization, potentially invoking tools with the server's authority.
Who is affected?: github.com/modelcontextprotocol/go-sdk github.com/modelcontextprotocol/go-sdk <= 1.4.0
What should defenders do?: Upgrade github.com/modelcontextprotocol/go-sdk to 1.4.1 or a later supported release; 1.4.1 requires Go 1.25 or later.
Is a fix available?: Yes. Upgrade to github.com/modelcontextprotocol/go-sdk 1.4.1.

01 / Response

What to do

Upgrade github.com/modelcontextprotocol/go-sdk to 1.4.1 or a later supported release; 1.4.1 requires Go 1.25 or later.
Configure authorization and origin protection before exposing an MCP HTTP server.

02 / Technical assessment

Evidence-backed analysis

The affected HTTP transport omitted origin and content-type checks. Exposure is especially relevant to stateless or sessionless servers without authorization; this is not an SDK-wide claim of remote code execution.

Maintainer confirms missing HTTP request validation and the patched release.
AIVirusDB maps the delegated tool-authority abuse to MCP confused deputy; field exploitation is not verified.

How to interpret evidence and confidence

03 / Timeline