All vulnerabilities

CVE-2026-81092

mcp-go before 0.56.0: missing Host header validation enables DNS rebinding

mediumCVSS 7.6CWE-346

Vendor

mcp-go

Package

mcp-go go

Affected

>= 0, < 0.56.0

Fixed in

0.56.0

Disclosed

2026-08-27

Credit

Avishai Gonen

dns-rebindingmcphost-header

Published advisory