Executive brief
mcp-go is a Go implementation of the Model Context Protocol (MCP), used to integrate language model applications with external tools and data sources. The library accepted HTTP requests on its loopback transports without validating the Host header, allowing an attacker to use DNS rebinding or browser-based attacks to access local tools and resources that should only be available to local software. This could lead to unauthorized tool invocation and data exposure.
Technical details
The vulnerability is a DNS rebinding / Host header bypass in mcp-go's HTTP transports (StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go). Both handlers accepted any request arriving over a loopback connection (127.0.0.1, ::1) without validating that the Host header matches a loopback name, and the SSE transport's cross-origin defaults allowed any origin. An attacker can craft a malicious web page that points a domain name under their control at 127.0.0.1 and invoke the target server's HTTP endpoints, bypassing the assumption that only local software can connect. Versions before 0.56.0 are vulnerable; 0.56.0 adds server/http_localhost.go which validates loopback Host headers and rejects non-loopback names on loopback-bound connections.
Affected products
- mark3labs mcp-go before 0.56.0
Timeline
- 2026-08-27: disclosed
- 2026-07-08: patched: Fix merged in PR #921; available in 0.56.0