Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:LSummary
CVE-2026-33252 is a high-severity CSRF (CWE-352) vulnerability in Lfprojects Mcp Go Sdk. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33252 is a cross-site request forgery (CSRF) vulnerability, classified under CWE-352, affecting the Go MCP SDK prior to version 1.4.1. The issue resides in the SDK's Streamable HTTP transport, which relies on Go's standard encoding/json package and accepts browser-generated cross-site POST requests without validating the Origin header or requiring a Content-Type of application/json. This flaw has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L), indicating high integrity impact with low availability impact and requiring user interaction.
An attacker can exploit this vulnerability by tricking a victim into visiting a malicious website, which then issues cross-site POST requests to the target's network-accessible MCP server. Exploitation is feasible in deployments lacking authorization, particularly stateless or sessionless configurations, allowing the attacker's site to send arbitrary MCP requests to a local server on the victim's network. Successful exploitation enables the attacker to trigger tool execution on the server, compromising integrity and potentially causing limited availability disruption, though no privileges or authentication are required on the attacker's part.
The Go MCP SDK version 1.4.1 patches this issue, as detailed in the project's security advisory (GHSA-89xv-2j6f-qhc8) and the corresponding commit (a433a831d6e5d5ac3b9e625a8095aa8eaa040dfc). Security practitioners should upgrade to at least version 1.4.1 and review deployments for missing authorization controls to mitigate exposure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14643
Vulnerability Data
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or…
more
sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.