Model Context Protocol

The Go SDK for MCP (github.com/modelcontextprotocol/go-sdk) had a flaw in its Streamable HTTP transport. It accepted browser-generated cross-site POST requests without validating the Origin header or requiring Content-Type: application/json. Without Authorization configured, especially in stateless or sessionless setups, any website could send MCP requests to a local server and potentially trigger tool execution. Cross-site POSTs with Content-Type: text/plain could reach message handling without a CORS preflight barrier.

The Go SDK for the Model Context Protocol moved to the segmentio/encoding library for JSON parsing in version 1.3.1. The new parser matched keys that had null Unicode characters appended to their base names, so combined with duplicate keys, a "last key wins" resolution could override the intended MCP message. This could let messages evade proxies or policy layers that match exact field names, and other MCP SDKs in TypeScript and Python would reject the same messages.

CVE-2026-4270 is an Improper Protection of Alternate Path flaw in the no-access and workdir file access features of the AWS API MCP Server, affecting awslabs.aws-api-mcp-server versions >= 0.2.14 and < 1.3.9 on all platforms. The flaw may allow an attacker to bypass the intended file access restriction and expose arbitrary local file contents in the MCP client application context.

The FastMCP OAuth Proxy ignores the client-supplied `resource` parameter in authorization and token requests and issues tokens for the `base_url` set at initialization instead. Because the tokens carry no resource information, a benign MCP server cannot verify that a token was issued for it. An attacker can run a malicious MCP server that advertises the benign proxy as its authorization server, capture the token from a victim's OAuth flow, and replay it against other MCP servers that share that authorization server.

LibreChat versions 0.8.2 through 0.8.2-rc3 have a flaw in the MCP (Model Context Protocol) OAuth callback endpoint. It stores OAuth tokens for the user who started the flow without checking that the browser completing the redirect is logged in or belongs to that same user. An attacker can send a victim the authorization URL, and the victim's tokens for linked services such as Atlassian and Outlook end up on the attacker's account, enabling account takeover.

mcp-atlassian's HTTP middleware and dependency layer accept an unvalidated X-Atlassian-Jira-Url (and the Confluence equivalent) from unauthenticated requests when no Authorization header is present. The server then issues an outbound GET to {header_url}/rest/api/2/myself, enabling server-side request forgery, which the advisory says can expose IAM credentials via 169.254.169.254 in cloud deployments and enable internal network reconnaissance and injection of attacker-controlled content into LLM tool results.

GitHub Copilot CLI's shell tool contains a vulnerability in which crafted bash parameter expansion patterns (such as ${var@P}, assignment forms like ${var=value}, indirect ${!var}, and nested $(cmd) inside ${...}) can hide command execution inside commands the safety assessment classifies as read-only. An attacker who can influence the commands the agent runs, for example through prompt injection in repository files, MCP server responses, or user instructions, could achieve arbitrary code execution on the user's workstation, even in modes that require approval for write operations. The issue affects versions prior to 0.0.423.

The Go MCP SDK parsed JSON-RPC and MCP messages with Go's standard encoding/json.Unmarshal, which matches keys case-insensitively and folds Unicode characters such as ſ (U+017F) and K (U+212A) to ASCII. A malicious MCP peer could send non-standard field casing, such as "Method" instead of "method", that the SDK silently accepted. This could let such messages bypass intermediary proxies or policy layers that match exact field names, and it made the Go SDK inconsistent with the case-sensitive TypeScript and Python SDKs.

CVE-2026-26029 affects sf-mcp-server, an implementation of the Salesforce MCP server for Claude for Desktop. The flaw is an OS command injection (CWE-78) caused by unsafe use of child_process.exec when building Salesforce CLI commands from user-controlled input. Successful exploitation lets an attacker run arbitrary shell commands with the privileges of the MCP server process.

CVE-2025-15063 is a command injection flaw in the execAsync method of the Ollama MCP Server. It stems from the lack of proper validation of a user-supplied string before the string is used in a system call. Remote attackers can exploit it without authentication to execute code in the context of the service account.

MCP Manager for Claude Desktop contains a command injection sandbox escape flaw tracked as CVE-2026-0757, reported as ZDI-CAN-27810. The flaw lies in processing of MCP config objects, where a user-supplied string is used in a system call without proper validation. A remote attacker who gets a target to visit a malicious page or open a malicious file can escape the sandbox and run arbitrary code at medium integrity.