Bug 2525106 (CVE-2026-81092) - CVE-2026-81092 github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation
Summary: CVE-2026-81092 github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerabili...
Keywords:
Status: NEW
Alias: CVE-2026-81092
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-27 17:01 UTC by OSIDB Bzimport
Modified: 2026-09-03 10:04 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-27 17:01:05 UTC
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's cross-origin default allowed any origin. A page in a browser could therefore point a name it controlled at the loopback address and reach a server listening there, invoking tools and reading resources that the server exposed on the assumption that only local software could connect. No release before 0.56.0 validated the header on either transport; 0.56.0 adds server/http_localhost.go, which rejects a loopback-bound request carrying a host that is not a loopback name, and wires it into both transports.


Note You need to log in before you can comment on or make changes to this bug.