Executive brief
Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
Affected products
- Go github.com/modelcontextprotocol/go-sdk
Junglewise Threat Intelligence
CVE-2026-33252: GO-2026-4773 - Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
CVE-2026-33252 · Severity: low · CVSS 3.1 · Published 2026-03-23
Technologies: github.com/modelcontextprotocol/go-sdk (Go). Vendors: Go.
Related threats
- modelcontextprotocol go-sdk DNS rebinding in HTTP handlers
- GO-2026-4770 - Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
- Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
- Model Context Protocol Go SDK improper case sensitivity in JSON-RPC parsing