Vibe Coding
mcp-go Served Any Loopback Request Regardless of the Host It Named (CVE-2026-81092, 7.6)
`StreamableHTTPServer.ServeHTTP` in `server/streamable_http.go` and `SSEServer.ServeHTTP` in `server/sse.go` served any request arriving over a loopback connection without checking the Host header, and the SSE transport's cross-origin handling was similarly unguarded. This matters more than the individual server CVEs beside it because mcp-go is a widely used Go MCP SDK: every stdio-to-HTTP server built on it inherits the hole, so a page in a browser can drive a developer's local MCP server via DNS rebinding.
Source
↳ Follow the thread