VulnSocial

CVE-2026-34742Disclosure(lfprojects / mcp_go_sdk)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.

lfprojects CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-1188

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_go_sdk

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-04-03); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
lfprojects
Products
mcp_go_sdk

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-03: 1Mentions · 2026-04-04: 1Technical Details · 2026-04-03: 1Technical Details · 2026-04-04: 104-0304-04
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-34742 - High The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. Wh... https://www.thehackerwire.com/vulnerability/CVE-2026-34742/ https://t.co/wZ6jcPbTqJ

    Post summary

    The tweet announces CVE‑2026‑34742 as a high‑severity DNS rebinding vulnerability in the Go MCP SDK before version 1.4.0, noting that default protection is disabled for HTTP servers. It contains no PoC, exploit, or patch information.

    1000059
    164 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-34742 The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default f… https://www.cve.org/CVERecord?id=CVE-2026-34742

    Post summary

    The text announces CVE-2026-34742, noting that the Go MCP SDK lacks default DNS rebinding protection before v1.4.0, with no PoC, exploit, or patch information provided.

    00000156
    56.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applfprojectsmcp_go_sdk---

Explore more

Back to dashboardlfprojects CVEsmcp_go_sdk vulnerabilities