Tag

Cross-Site Request Forgery

1 brief RSS

Go MCP SDK Vulnerable to Cross-Site POST Requests (CVE-2026-33252)

The Go MCP SDK before v1.4.1 is vulnerable to cross-site POST requests due to insufficient origin validation and content type enforcement, potentially leading to arbitrary tool execution on local servers in stateless or sessionless deployments.

cve-2026-33252 cross-site request forgery go-mcp-sdk

1r 1t Mar 24, 2026