CVE-2026-27896Disclosure(lfprojects / mcp_go_sdk)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

Patch lfprojects mcp_go_sdk systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.

lfprojects CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

Other references

Weakness type (CWE)

CWE-178CWE-436

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mcp_go_sdk

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked at 3 mentions on most recent observed day (2026-02-27)
4 total mentions across 2 days

Affected systems

Vendors

lfprojects

Products

mcp_go_sdk

Deep dive

Activity timeline4 mentions / 2d

Signal classification2 categories

Disclosure

375.0%

Exploit

125.0%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-26	1	Disclosure1
2026-02-27	3	Disclosure2Exploit1

Full discourse4 posts

Mr. OS@ksg93rd223d
Exploit
#exploit 1⃣. CVE-2026-2441: https://github.com/huseyinstif/CVE-2026-2441-PoC Google Chrome Blink RCE 2⃣. CVE-2026-27896: https://dev.to/cverports/cve-2026-27896-case-insensitive-chaos-bypassing-security-controls-in-mcp-go-sdk-jag Bypassing Security Controls in MCP Go SDK 3⃣. CVE-2026-20841: https://github.com/tangent65536/CVE-2026-20841 Windows Notepad RCE 4⃣. CVE-2026-20817: https://github.com/oxfemale/CVE-2026-20817 Windows Error Reporting ALPC Privilege Escalation 5⃣. CVE-2026-25253: https://github.com/ethiack/moltbot-1click-rce Clawdbot/Moltbot/OpenClaw One-click RCE
Post summary
The post lists multiple CVEs with direct links to GitHub repositories containing functional exploit code, indicating the availability of exploits rather than merely proof of concept.
0202014708
3.1K followersView on X
jiayun@jiayun223d
Disclosure
🚀 Top 10 AI & Dev News of the Day! 🧵👇 🚨 Claude Code RCE Flaws: Check Point Research discovered critical vulnerabilities (like CVE-2025-59536) in Claude Code that allow remote code execution and API key theft simply by opening malicious repositories. https://www.bankinfosecurity.com/malicious-repo-files-could-hijack-claude-code-sessions-a-30854 ⚠️ Gemini API Data Leaks: Legacy public Google Cloud API keys (like Maps or Firebase) are silently inheriting unauthorized access to Gemini endpoints, exposing private files and creating massive billing risks. https://ift.tt/JiALlab ⚔️ Anthropic Defies the Pentagon: CEO Dario Amodei publicly rejected the DoD's ultimatum, refusing to drop Claude's safety guardrails against autonomous lethal weapons and mass domestic surveillance. https://ift.tt/hL2AqHi 🐛 MCP Go SDK Vulnerability: Upgrade to v1.3.1 immediately! A high-severity flaw (CVE-2026-27896) allows attackers to bypass security filters due to case-insensitive JSON parsing. https://ift.tt/0QNCImq 📱 Claude Code Remote Control: Anthropic launched a highly-requested feature letting developers seamlessly control and monitor their local terminal coding sessions directly from their phones. https://ift.tt/u3OLgIP 🤖 Microsoft Copilot Tasks: Microsoft unveiled an autonomous background agent that plans and executes multi-step workflows (like calendar management or web research) across different apps without constant human input. https://ift.tt/SdL6NjA 🤝 Copilot Welcomes Claude & Codex: GitHub Copilot Pro and Business users can now select Anthropic's Claude and OpenAI's Codex as their coding agents directly inside VS Code at no extra cost. https://ift.tt/C8WUYGR 🛡️ MCP Server Security Audit: An independent scan of the top 20 Model Context Protocol (MCP) servers revealed that 60% contain real vulnerabilities, including critical arbitrary command execution flaws in Kubernetes servers. https://ift.tt/WrzYOle 🎨 Figma integrates OpenAI Codex: Figma launched a new workflow via its MCP server that connects its infinite design canvas directly to Codex, allowing teams to seamlessly translate UI designs into code. https://ift.tt/I3MuOlk 🖼️ Google's Nano Banana 2: Google shipped Gemini 3.1 Flash Image, crushing the competition by taking the #1 spot on text-to-image leaderboards while costing half the price of Pro models. https://www.latent.space/p/ainews-nano-banana-2-aka-gemini-31 #AI #MachineLearning #CyberSecurity #SoftwareDevelopment #TechNews #WebDev #OpenAI #Anthropic #GitHubCopilot
Post summary
The tweet discloses several new CVEs with technical details and urges a patch for one vulnerability, but does not confirm active exploitation or provide exploit code.
01031166
199 followersView on X
cvereports@_cvereports223d
Disclosure
CVE-2026-27896: Case-Insensitive Chaos: Bypassing Security Controls in MCP Go SDK A high-severity interpretation conflict in the Model Context Protocol (MCP) Go SDK allows attackers to bypass security intermediaries. By exploiting Go's standard librar... https://cvereports.com/reports/CVE-2026-27896
Post summary
The report announces a high‑severity vulnerability in the MCP Go SDK that enables attackers to bypass security controls through an interpretation conflict, with no exploit or patch details provided.
0000037
32 followersView on X
CVE@CVEnew224d
Disclosure
CVE-2026-27896 The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs cas… https://www.cve.org/CVERecord?id=CVE-2026-27896
Post summary
The CVE-2026-27896 vulnerability involves the Go MCP SDK's use of encoding/json.Unmarshal for JSON‑RPC parsing in versions before 1.3.1, as documented in the CVE record.
00000134
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	lfprojects	mcp_go_sdk	-	-	-

Explore more

Back to dashboard lfprojects CVEs mcp_go_sdk vulnerabilities

What researchers are saying

CVE-2026-27896

jiayun[verified]@jiayunDisclosure

The tweet discloses several new CVEs with technical details and urges a patch for one vulnerability, but does not confirm active exploitation or provide exploit code.

Mr. OS@ksg93rdExploit

The post lists multiple CVEs with direct links to GitHub repositories containing functional exploit code, indicating the availability of exploits rather than merely proof of concept.

cvereports@_cvereportsDisclosure

The report announces a high‑severity vulnerability in the MCP Go SDK that enables attackers to bypass security controls through an interpretation conflict, with no exploit or patch details provided.

CVE@CVEnewDisclosure

The CVE-2026-27896 vulnerability involves the Go MCP SDK's use of encoding/json.Unmarshal for JSON‑RPC parsing in versions before 1.3.1, as documented in the CVE record.