CVE-2026-81092

Name of the Vulnerable Software and Affected Versions mcp-go versions prior to 0.56.0

Description The software accepts requests on its HTTP transports without validating the Host header. Specifically, the StreamableHTTPServer.ServeHTTP function in server/streamable http.go and the SSEServer.ServeHTTP function in server/sse.go process any request arriving over a loopback connection regardless of the specified host. Additionally, the Server-Sent Events (SSE) transport default configuration allows any origin. This allows a browser-based page to point a controlled name to the loopback address and access the server, potentially invoking tools and reading resources intended only for local software.

Recommendations Update to version 0.56.0.