CVE-2026-33252: Go MCP SDK CSRF Vulnerability

CVE-2026-33252 Overview

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Go MCP SDK's Streamable HTTP transport prior to version 1.4.1. The vulnerability stems from the SDK accepting browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments lacking Authorization, particularly stateless or sessionless configurations, this flaw allows arbitrary websites to send MCP requests to local servers and potentially trigger unauthorized tool execution.

Critical Impact

Malicious websites can exploit this vulnerability to execute MCP tool commands on local servers without user consent, potentially leading to unauthorized actions and data manipulation in vulnerable deployments.

Affected Products

• Go MCP SDK versions prior to 1.4.1
• Deployments using Streamable HTTP transport without Authorization
• Stateless or sessionless MCP server configurations

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33252 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33252

Vulnerability Analysis

This vulnerability falls under CWE-352 (Cross-Site Request Forgery). The Go MCP SDK's Streamable HTTP transport implementation failed to implement proper safeguards against cross-origin requests. The core issue lies in two missing validation checks: the Origin header verification and the Content-Type: application/json requirement.

When a web browser makes cross-site POST requests, it typically includes an Origin header indicating the source domain. Servers should validate this header to ensure requests originate from trusted sources. Additionally, requiring specific content types like application/json acts as a defense mechanism because browsers cannot set custom Content-Type headers for cross-origin requests without triggering CORS preflight checks.

Without these validations, any malicious website could craft requests that appear legitimate to the MCP server, bypassing the browser's same-origin policy protections. This is particularly dangerous in local development environments where MCP servers may run without authentication.

Root Cause

The root cause is the absence of proper cross-origin request validation in the Streamable HTTP transport layer. The SDK used Go's standard encoding/json library but did not implement the necessary security headers validation that would prevent CSRF attacks. The server accepted POST requests regardless of their origin and without enforcing content-type restrictions that would normally trigger browser CORS preflight requests.

Attack Vector

An attacker can exploit this vulnerability by hosting a malicious webpage that automatically submits cross-site POST requests to a victim's local MCP server. The attack requires user interaction (visiting the malicious page) but no further user consent. The attack flow involves:

1. Victim runs an MCP server locally without Authorization enabled
2. Victim visits attacker-controlled webpage
3. Malicious JavaScript on the page sends POST requests to the local MCP server
4. Server processes requests without validating origin, executing MCP tools

The security patch addresses this by adding validation for both Origin and Content-Type headers:

//go:generate weave -o ../../docs/server.md ./server.src.md
//go:generate weave -o ../../docs/troubleshooting.md ./troubleshooting.src.md
//go:generate weave -o ../../docs/rough_edges.md ./rough_edges.src.md
//go:generate weave -o ../../docs/mcpgodebug.md ./mcpgodebug.src.md

// The doc package generates the documentation at /doc, via go:generate.
//

Source: GitHub Commit

Detection Methods for CVE-2026-33252

Indicators of Compromise

• Unexpected MCP tool executions in server logs without corresponding legitimate user actions
• HTTP POST requests to MCP endpoints with unusual or missing Origin headers
• Server access logs showing requests from browser user agents with cross-origin referrers
• Anomalous patterns of tool execution that coincide with user web browsing activity

Detection Strategies

• Monitor MCP server logs for requests lacking proper Origin header validation
• Implement network traffic analysis to detect cross-origin POST requests to local MCP endpoints
• Review application logs for unexpected tool execution patterns
• Deploy web application firewalls to detect and block suspicious cross-site request patterns

Monitoring Recommendations

• Enable verbose logging on MCP servers to capture all incoming request headers
• Set up alerts for MCP tool executions that occur without accompanying authentication events
• Monitor for requests with Content-Type values other than application/json
• Implement anomaly detection for unusual request patterns targeting MCP endpoints

How to Mitigate CVE-2026-33252

Immediate Actions Required

• Upgrade Go MCP SDK to version 1.4.1 or later immediately
• Enable Authorization on all MCP server deployments, especially those accessible via HTTP
• Review and audit existing MCP server configurations for missing authentication
• Implement network segmentation to limit access to local MCP servers

Patch Information

The vulnerability is patched in Go MCP SDK version 1.4.1. The patch implements proper validation of Origin and Content-Type headers in the Streamable HTTP transport layer. For detailed information, refer to the GitHub Security Advisory GHSA-89xv-2j6f-qhc8 and the security patch commit.

Workarounds

• Enable Authorization on MCP servers even in development environments
• Configure reverse proxies to validate Origin headers before forwarding requests
• Restrict MCP server binding to localhost with additional network controls
• Implement CORS policies at the infrastructure level if SDK upgrade is not immediately possible

# Configuration example
# Update go.mod to use patched version
go get github.com/modelcontextprotocol/go-sdk@v1.4.1

# Verify the updated version
go list -m github.com/modelcontextprotocol/go-sdk