CVE-2026-33252: 
Wolfi vulnerability analysis and mitigation

CVE-2026-33252 is a Cross-Site Request Forgery (CSRF) vulnerability in the Model Context Protocol (MCP) Go SDK (github.com/modelcontextprotocol/go-sdk) that enables cross-site tool execution against HTTP servers without authorization. The vulnerability affects all versions up to and including v1.4.0 of the Go SDK. It was reported by Lê Minh Quân (GitHub: aleister1102), published on March 18, 2026, and patched in v1.4.1. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, MCP Go SDK Advisory).

The root cause is classified as CWE-352 (Cross-Site Request Forgery) and CWE-940 (Improper Verification of Source of a Communication Channel). The Go SDK's Streamable HTTP transport failed to validate the Origin header on incoming POST requests and did not enforce Content-Type: application/json. Because Content-Type: text/plain is a CORS-safelisted header value, browsers will send such requests cross-origin without triggering a CORS preflight check, allowing a malicious website to deliver MCP protocol messages directly to a locally running MCP server. The attack is particularly effective against stateless or sessionless server deployments that lack an Authorization header requirement. The fix in commit a433a83 introduced http.CrossOriginProtection (available in Go 1.25+) and enforces Content-Type: application/json validation on all POST requests (GitHub Advisory, Patch Commit).

Successful exploitation allows an arbitrary malicious website to send crafted MCP requests to a locally running MCP server on behalf of a victim user, potentially triggering arbitrary tool execution registered with that server. The primary impact is a high integrity loss — an attacker can cause the MCP server to execute tools or actions it would not otherwise perform — with low availability impact and no direct confidentiality impact per the CVSS scoring. The risk is highest in developer environments or local deployments where MCP servers run without authorization controls, as these are the configurations most susceptible to cross-site tool invocation (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.009% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must visit a malicious website while a vulnerable, authorization-free MCP server is running locally — which limits the practical attack surface (GitHub Advisory).

1. Reconnaissance: Identify a target running a vulnerable MCP Go SDK server (version ≤ 1.4.0) with Streamable HTTP transport enabled and no Authorization header requirement, typically on localhost (e.g., http://localhost:PORT/mcp).
2. Craft malicious webpage: Create a webpage containing JavaScript that issues a cross-origin POST request to the target MCP server endpoint using Content-Type: text/plain (a CORS-safelisted content type that bypasses preflight checks).
3. Embed MCP payload: Construct a valid MCP JSON-RPC message body (e.g., a tool invocation request) and include it as the POST body. Because the server does not validate Content-Type or Origin, the message is accepted and processed.
4. Deliver to victim: Lure the victim user to visit the malicious webpage while their MCP server is running locally. The browser sends the cross-origin POST without a CORS preflight, and the MCP server processes the request.
5. Trigger tool execution: The MCP server executes the requested tool or action as if it were a legitimate client request, achieving the attacker's objective (e.g., file access, command execution, or data manipulation depending on registered tools) (GitHub Advisory, Patch Commit).

• Network: Unexpected POST requests to the MCP server endpoint (e.g., http://localhost:<PORT>/mcp) originating from browser processes with Content-Type: text/plain or missing Content-Type: application/json; Origin header in requests pointing to an external or unknown domain.
• Logs: MCP server access logs showing POST requests with Content-Type: text/plain that were processed successfully (pre-patch); requests from Origin values that do not match expected client origins.
• Process: Unexpected tool executions or side effects triggered on the MCP server (e.g., file system changes, outbound network connections, or subprocess spawning) that do not correspond to legitimate client activity.

Users should upgrade to github.com/modelcontextprotocol/go-sdk v1.4.1, which enforces Content-Type: application/json validation on POST requests and enables cross-origin protection via http.CrossOriginProtection. Note that v1.4.1 requires Go 1.25 or later. As a temporary workaround for deployments that cannot upgrade immediately, adding an Authorization requirement to the MCP server will prevent unauthenticated cross-site requests from being processed. The disablecrossoriginprotection MCPGODEBUG option can be used to temporarily revert the new protection behavior, but this is not recommended for production use and will be removed in v1.6.0 (GitHub Advisory, Patch Commit).

The vulnerability was disclosed via the GitHub Security Advisory program and tracked by Red Hat's Product Security team in Bugzilla, indicating it received attention from enterprise Linux distribution maintainers. SUSE also issued a security announcement referencing the vulnerability. Community discussion was limited, with a Bluesky post from a cybersecurity blog noting the advisory. No significant researcher commentary or media coverage beyond standard vulnerability tracking was identified (Red Hat Bugzilla, GitHub Advisory).