CVE-2026-34742

Medium

Elevated severity or exploit probability.

CVSS base

8.1 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS — probability of exploitation (30 days)

0.5%

38.8th percentile

CISA KEV

Not listed

Weakness / dates

CWE-1188

Published 2026-04-02 · modified 2026-07-24

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	R	Required
Scope	U	Unchanged
Confidentiality	H	High
Integrity	H	High
Availability	N	None

Timeline

2026-04-02 — Published (NVD)
2026-07-24 — Last modified (NVD)

Description

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.

Affected

lfprojects

References

Official: NVD · CVE.org