CVE-2026-33252
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Mar 24, 2026
CISA due date
—
The record
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | datadog-cluster-agent-7.76 | 0 | 7.76.3-r4 |
| Chainguard | datadog-cluster-agent-fips-7.76 | 0 | 7.76.3-r4 |
| Chainguard | ferretdb | 0 | 2.7.0-r10 |
| Chainguard | flux-operator-mcp | 0 | 0.45.0-r3 |
| Chainguard | flux-operator-mcp-fips | 0 | 0.45.0-r2 |
| Chainguard | gitlab-workhorse-ce-18.8 | 0 | 18.8.7-r1 |
| Chainguard | gitlab-workhorse-ce-18.9 | 0 | 18.9.3-r0 |
| Chainguard | gitlab-workhorse-ce-fips-18.8 | 0 | 18.8.7-r1 |
| Chainguard | gitlab-workhorse-ce-fips-18.9 | 0 | 18.9.3-r1 |
| Chainguard | glab | 0 | 1.90.0-r0 |
| Chainguard | jaeger-2-all-in-one | 0 | 2.16.0-r3 |
| Chainguard | jaeger-2-collector | 0 | 2.16.0-r3 |
| Chainguard | jaeger-2-fips-all-in-one | 0 | 2.16.0-r2 |
| Chainguard | jaeger-2-fips-collector | 0 | 2.16.0-r2 |
| Chainguard | jaeger-2-fips-ingester | 0 | 2.16.0-r2 |
| Chainguard | jaeger-2-fips-jaeger | 0 | 2.16.0-r2 |
| Chainguard | jaeger-2-fips-query | 0 | 2.16.0-r2 |
| Chainguard | jaeger-2-ingester | 0 | 2.16.0-r3 |
| Chainguard | jaeger-2-jaeger | 0 | 2.16.0-r3 |
| Chainguard | jaeger-2-query | 0 | 2.16.0-r3 |
| Chainguard | livekit-cli | 0 | 2.16.0-r3 |
| Chainguard | opencost | 0 | 1.119.2-r7 |
| Chainguard | opencost-fips | 0 | 1.119.2-r6 |
| Chainguard | osv-scanner | 0 | 2.3.3-r7 |
| Wolfi | datadog-cluster-agent-7.76 | 0 | 7.76.3-r4 |
| Wolfi | ferretdb | 0 | 2.7.0-r10 |
| Wolfi | flux-operator-mcp | 0 | 0.45.0-r3 |
| Wolfi | glab | 0 | 1.90.0-r0 |
| Wolfi | jaeger-2-all-in-one | 0 | 2.16.0-r3 |
| Wolfi | jaeger-2-collector | 0 | 2.16.0-r3 |
| Wolfi | jaeger-2-ingester | 0 | 2.16.0-r3 |
| Wolfi | jaeger-2-jaeger | 0 | 2.16.0-r3 |
| Wolfi | jaeger-2-query | 0 | 2.16.0-r3 |
| Wolfi | opencost | 0 | 1.119.2-r7 |
| Wolfi | osv-scanner | 0 | 2.3.3-r7 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260326T203309-150000.1.155.2 |
Related vulnerabilities
- CVE-2026-27896 The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol… Also affects datadog-cluster-agent-7.76
- CVE-2024-27304 pgx is a PostgreSQL driver and toolkit for Go. Also affects ferretdb
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects flux-operator-mcp
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects flux-operator-mcp
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects flux-operator-mcp
- CVE-2026-23990 The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux… Also affects flux-operator-mcp
- CVE-2026-33809 A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB… Also affects gitlab-workhorse-ce-18.8
- CVE-2025-58190 The html.Parse function in golang.org/x/net/html has an infinite parsing loop when… Also affects gitlab-workhorse-ce-18.8