CVE database · Model Context Protocol (MCP)
MCP Go SDK vulnerabilities and CVEs
The Beam CVE database tracks 4 security advisories for MCP Go SDK: 4 high severity. The newest is CVE-2026-34742, published Apr 1, 2026 and fixed in 1.4.0.
The official Go SDK for MCP servers and clients.
Check your version: go list -m github.com/modelcontextprotocol/go-sdk
- Vulnerabilities tracked
- 4
- Critical
- 0
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-34742
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost
high8.1Apr 1, 2026CVE-2026-33252
Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
high7.1Mar 19, 2026GHSA-q382-vc8q-7jhj
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
high8.2Mar 19, 2026CVE-2026-27896
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
high7.0Feb 26, 2026