The Go MCP SDK relied on Go's standard encoding/json library and its Streamable HTTP transport accepted browser‑generated cross‑site POST requests without validating the Origin header or requiring a Content‑Type of application/json. When deployed without authorization—especially in stateless or sessionless configurations—an attacker can host a malicious web page that submits MCP requests to a local server and can cause tools defined by the SDK to execute. This allows an attacker to run arbitrary commands on the host, representing a remote code execution flaw rooted in missing origin validation and improper input handling (CWE‑352 and CWE‑940).

Affected systems are those using the Modelcontextprotocol Go SDK product, modelcontextprotocol:go-sdk. The vulnerability exists in all versions prior to 1.4.1. Servers running any of those earlier releases in a configuration that does not enforce authorization for the HTTP endpoints are susceptible. The issue applies to any environment that hosts the SDK’s streamable transport and is reachable from a web browser, regardless of operating system.

The CVSS base score of 7.1 indicates a high severity, and although the EPSS score is not available, the lack of a KEV listing does not diminish the potential danger. Attackers can exploit the flaw by simply loading a malicious page that triggers cross‑site POSTs to the vulnerable endpoint; no special credentials or privileged access are required. Because the server trusts the request without validating the origin, the attack is likely to succeed against users who already have network connectivity to the target server. The risk rises in environments where the SDK is exposed to the internet or to untrusted internal networks.