Bug 2450542 (CVE-2026-33252)

Summary: CVE-2026-33252 encoding/json: golang: github.com/modelcontextprotocol/go-sdk: Go MCP SDK: Remote tool execution via cross-site request forgery
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anpicker, bparees, dfreiber, dhanak, drosa, drow, dsimansk, hasun, jburrell, jfula, jkoehler, jowilson, kbempah, kingland, kverlaen, lphiri, mnovotny, nyancey, ometelka, ptisnovs, sausingh, sdawley, solenoci, syedriko, vkumar, xdharmai
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Go MCP SDK's Streamable HTTP transport, which uses Go's standard `encoding/json` package. In deployments without authorization, a remote attacker can exploit this Cross-Site Request Forgery (CSRF) vulnerability. By sending browser-generated cross-site `POST` requests to a local server without proper validation of the `Origin` header or `Content-Type`, an attacker can potentially trigger unauthorized tool execution.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2450665, 2450666, 2450667, 2450668    
Bug Blocks:    

Description OSIDB Bzimport 2026-03-24 00:01:52 UTC
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.