CVE-2026-27896: Github.com/modelcontextprotocol/go sdk MCP Go SDK Vulnerable To Vulnerability
HIGHCVE-2026-27896 is a HIGH mcp go sdk vulnerable to vulnerability (CWE-436: Interpretation Conflict) affecting Github.com/modelcontextprotocol/go sdk libraries in the Go ecosystem. The issue involves mcp go sdk vulnerable to improper handling of case sensitivity. Remediation is available by upgrading affected packages to version 1.3.1.
CVE-2026-27896 at a Glance
How to Fix CVE-2026-27896
To remediate this vulnerability, upgrade all affected Github.com/modelcontextprotocol/go sdk dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/modelcontextprotocol/go-sdk to 1.3.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/modelcontextprotocol/go-sdkHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-27896, inspect your project dependencies for Github.com/modelcontextprotocol/go sdk:
inspect dependencies for github.com/modelcontextprotocol/go-sdkAnalyze the terminal output to locate any version of Github.com/modelcontextprotocol/go sdk in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-436: Interpretation Conflict, where product a handles inputs or steps differently than product b, which causes a to perform incorrect actions based on its perception of b's state. In Github.com/modelcontextprotocol/go sdk, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-27896 Affected Github.com/modelcontextprotocol/go sdk Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/modelcontextprotocol/go-sdk
|
Go |
< 1.3.1
|
1.3.1
|
References
Frequently Asked Questions
What is CVE-2026-27896?
Which Github.com/modelcontextprotocol/go sdk versions are affected?
What version fixes CVE-2026-27896?
Is github.com/modelcontextprotocol/go-sdk affected?
What CWE is associated with CVE-2026-27896?
How can I check Go dependencies for CVE-2026-27896?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wvj2-96wp-fq3f",
"modified" : "2026-02-26T22:20:08Z",
"published" : "2026-02-26T22:20:08Z",
"aliases" : [ "CVE-2026-27896" ],
"summary" : "MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity",
"details" : "The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:\"method\" would also match \"Method\", \"METHOD\", etc. Additionally, Go's standard library folds the Unicode characters ſ (U+017F) and K (U+212A) to their ASCII equivalents s and k, meaning fields like \"paramſ\" would match \"params\". This violated the JSON-RPC 2.0 specification, which defines exact field names.\n\n#### Impact:\n\nA malicious MCP peer may have been able to send protocol messages with non-standard field casing (e.g., \"Method\" instead of \"method\") that the SDK would silently accept. This had the potential for:\n - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n#### Fix:\n\nGo's standard JSON unmarshaling was replaced with a case-sensitive decoder (github.com/segmentio/encoding) in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.\n\n#### Credits:\nMCP Go SDK thanks Francesco Lacerenza (Doyensec) for reporting this issue.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/modelcontextprotocol/go-sdk"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.3.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-27896"
}, {
"type" : "WEB",
"url" : "https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/modelcontextprotocol/go-sdk"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-178", "CWE-436" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-02-26T22:20:08Z",
"nvd_published_at" : "2026-02-26T01:16:25Z"
}
}