mcp-go CVE-2026-81092

Two simultaneous conditions are required: the victim must be running an mcp-go server (version before 0.56.0) bound to a loopback address (127.0.0.1 or ::1), and the victim must visit an attacker-controlled web page in a browser. The attacker must also complete a DNS rebinding maneuver - resolving their domain to 127.0.0.1 in the victim's browser by exploiting short DNS TTLs or browser DNS-pinning weaknesses - which is represented as AT:P in the CVSS 4.0 vector and is the primary attack complexity constraint. The SSE transport's permissive CORS default removes one additional browser-level barrier for that transport specifically. No authentication to the mcp-go server is required (PR:N), but a server must be actively running and exposing tools or resources. Exploitation is browser-mediated only; direct network connections from non-loopback addresses are not affected, and the vulnerability does not apply when the server is bound to a non-loopback interface.

The CVSS 4.0 score of 7.6 reflects AT:P (attack requirement: victim must be running mcp-go locally) and UI:P (victim must visit a malicious page), which meaningfully constrain real-world exploitation compared to fully automated network-vector attacks. No EPSS data was provided in the input, so exploitation probability cannot be quantified from this dataset. There is no CISA KEV listing and no public exploit has been identified, reducing urgency compared to actively exploited issues. That said, MCP servers are disproportionately deployed on developer workstations and CI/CD hosts where the attack surface is real - MCP tools routinely expose file reads, shell execution, and credential access, making the high confidentiality and integrity impact ratings (VC:H, VI:H) credible rather than theoretical. Teams running mcp-go-based servers in local development environments should treat this as a priority patch, particularly given that the fix is a simple version bump with no API-breaking changes.

An attacker registers a domain that briefly resolves to 127.0.0.1 through a DNS rebinding maneuver - exploiting short TTLs or DNS pinning bypasses - then serves a page that the victim developer visits while an mcp-go server is running locally. The page's JavaScript issues requests to the local MCP server with the attacker's domain as the Host header; without Host validation, the server accepts them, allowing the attacker's page to enumerate and invoke MCP tools (potentially reading local files, executing shell commands, or accessing credentials) entirely from within the browser. No public exploit code has been identified, but standard DNS rebinding toolkits provide ready infrastructure for this attack pattern.