CVE-2026-33252

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-332538.4SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on t CVE-2026-332547.5An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to a CVE-2026-332567.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332577.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332587.5By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.CVE-2026-332595.0Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally CVE-2026-33268.6The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX act CVE-2026-332607.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The i CVE-2026-332615.9A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.CVE-2026-332625.9An attacker can send replies that result in a null pointer dereference, caused by a missing consistency check and leading to a denial of ser CVE-2026-332634.3When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor ha CVE-2026-332649.8A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / AP