Cloudanix VulnDB

CVE-2026-27896

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Feb 26, 2026

CISA due date

—

The record

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/modelcontextprotocol/go-sdk 0 1.3.1
Chainguard datadog-cluster-agent-7.76 0 7.76.1-r1
Chainguard datadog-cluster-agent-fips-7.76 0 7.76.1-r2
Chainguard ferretdb 0 2.7.0-r7
Chainguard flux-operator-mcp 0 0.43.0-r1
Chainguard flux-operator-mcp-fips 0 0.41.1-r1
Chainguard github-mcp-server 0 0.31.0-r1
Chainguard gitlab-workhorse-ce-18.7 0 18.7.5-r1
Chainguard gitlab-workhorse-ce-18.8 0 18.8.5-r1
Chainguard gitlab-workhorse-ce-18.9 0 18.9.1-r1
Chainguard gitlab-workhorse-ce-fips-18.7 0 18.7.5-r1
Chainguard gitlab-workhorse-ce-fips-18.8 0 18.8.5-r1
Chainguard gitlab-workhorse-ce-fips-18.9 0 18.9.1-r1
Chainguard gptscript 0 0.9.8-r35
Chainguard jaeger-2-all-in-one 0 2.15.1-r1
Chainguard jaeger-2-collector 0 2.15.1-r1
Chainguard jaeger-2-fips-all-in-one 0 2.15.1-r1
Chainguard jaeger-2-fips-collector 0 2.15.1-r1
Chainguard jaeger-2-fips-ingester 0 2.15.1-r1
Chainguard jaeger-2-fips-jaeger 0 2.15.1-r1
Chainguard jaeger-2-fips-query 0 2.15.1-r1
Chainguard jaeger-2-ingester 0 2.15.1-r1
Chainguard jaeger-2-jaeger 0 2.15.1-r1
Chainguard jaeger-2-query 0 2.15.1-r1
Chainguard opencost 0 1.119.2-r1
Chainguard opencost-fips 0 1.119.2-r1
Chainguard osv-scanner 0 2.3.3-r2
Wolfi datadog-cluster-agent-7.76 0 7.76.1-r1
Wolfi ferretdb 0 2.7.0-r7
Wolfi flux-operator-mcp 0 0.43.0-r1
Wolfi github-mcp-server 0 0.31.0-r1
Wolfi gptscript 0 0.9.8-r35
Wolfi jaeger-2-all-in-one 0 2.15.1-r1
Wolfi jaeger-2-collector 0 2.15.1-r1
Wolfi jaeger-2-ingester 0 2.15.1-r1
Wolfi jaeger-2-jaeger 0 2.15.1-r1
Wolfi jaeger-2-query 0 2.15.1-r1
Wolfi opencost 0 1.119.2-r1
Wolfi osv-scanner 0 2.3.3-r2
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260317T205859-150000.1.152.1

Related vulnerabilities