Description

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's cross-origin default allowed any origin. A page in a browser could therefore point a name it controlled at the loopback address and reach a server listening there, invoking tools and reading resources that the server exposed on the assumption that only local software could connect. No release before 0.56.0 validated the header on either transport; 0.56.0 adds server/http_localhost.go, which rejects a loopback-bound request carrying a host that is not a loopback name, and wires it into both transports.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T17:20:51.337Z",
  "pubdate": "2026-08-27T17:20:51.337Z",
  "executiveSummary": "The mcp-go library is susceptible to a vulnerability involving improper validation of the Host header in its HTTP and SSE transport implementations. By failing to verify that incoming requests on loopback interfaces originate from authorized hostnames, the server becomes vulnerable to Cross-Site Request Forgery (CSRF) and DNS Rebinding attacks.\nThe vulnerability affects both StreamableHTTPServer and SSEServer components. An attacker can leverage a malicious website to send unauthorized requests to local services running on the loopback interface, effectively bypassing the implicit trust boundary typically afforded to local software. This allows remote attackers to interact with local tools and sensitive resources exposed by the mcp-go server.\nThe risk is significant as the flaw permits unauthorized execution of functions and data exfiltration without requiring elevated privileges. Mitigation requires updating to version 0.56.0 or later, which introduces mandatory Host header validation for all loopback-bound traffic.",
  "technicalDetails": "The vulnerability resides in the core HTTP and SSE transport handlers within the mcp-go library, specifically identified in server/streamable_http.go (StreamableHTTPServer.ServeHTTP) and server/sse.go (SSEServer.ServeHTTP). The root cause is a deficiency in transport-layer security where the server processes incoming requests bound to the loopback address without validating the 'Host' header against an allowlist of permitted local loopback names.\nIn the default configuration prior to version 0.56.0, the SSE transport implementation permitted cross-origin requests by default, failing to enforce strict origin checks. This architecture creates a classic DNS Rebinding vector. An attacker can direct a victim's browser to resolve an attacker-controlled domain to '127.0.0.1' or 'localhost'. Because the mcp-go server does not validate the Host header, it treats these requests as legitimate local traffic, ignoring the discrepancy between the expected local host and the spoofed domain name provided by the browser.\nThe attack flow follows these steps: 1) The attacker lures a user to a malicious webpage; 2) The webpage initiates an HTTP or SSE request directed at the user's loopback interface; 3) Due to the lack of Host header validation, the mcp-go server accepts the request, assuming it originates from a trusted local process; 4) The server executes the requested tool or returns sensitive resource data to the attacker-controlled script, effectively granting the attacker the ability to interact with the service as if they were a local user.\nThe vulnerability essentially nullifies the network-layer isolation provided by binding to the loopback interface, as the application layer remains exposed to requests initiated from external browser contexts. The fix implemented in version 0.56.0 introduces a dedicated validation layer via server/http_localhost.go. This component forces the server to inspect the Host header for every incoming connection to the loopback interface, explicitly rejecting any request where the Host header does not match a verified loopback identifier. This change acts as a definitive safeguard against DNS Rebinding and cross-origin exploitation attempts, ensuring that only requests clearly originating from the intended local environment are processed."
}