The vulnerability arises because mcp-go served HTTP requests on loopback interfaces without validating the Host header. Requests arriving on a loopback connection with any Host value are accepted by both the StreamableHTTPServer and SSEServer transports. A malicious web page can therefore point a controlled domain name to the loopback address, bypass the same‑origin restriction, and access services that expect only local connections. This can expose confidential data, enable unauthorized configuration changes, or potentially allow further exploitation of the local server process.

Mark3 Labs mcp‑go versions earlier than 0.56.0 are affected. The 0.56.0 release introduced validation that rejects loopback requests whose Host header is not a loopback name.

The CVSS score of 7.6 indicates a medium‑high risk. The EPSS score of 0.00165 (<1%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a DNS rebinding or cross‑origin request from an external web page, which can be orchestrated over the public Internet. An attacker who can host a malicious page can send requests that target the local server, potentially exposing internal resources or enabling further compromise. The attack requires only a web browser and a controlled domain name; no privileged local access is needed, but the local service must be reachable and accept untrusted traffic.