CVE-2026-81092

A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...