Disclosed vulnerability
CVE-2026-81092: mcp-go served any loopback request regardless of Host, exposing local MCP servers to DNS rebinding
AIR-2026-0205 AIR record · 2026-08-mcp-go-loopback-host-dns-rebinding
From the supporting source
StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named.github.com
The record
Disclosed
2026-08-27
Vendor
mcp-go maintainers (mark3labs)
Product
mcp-go (Go MCP SDK)
Risk domain
Access control and permissions › Confused deputy
System type
Generative model
Who acted
AI was the target — a missing Host check exposes local MCP servers to DNS rebinding
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Malicious website dns rebinding to localhost
Impact type
Unauthorized tool invocation, Data access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any local MCP server built on mcp-go < 0.56.0 using the StreamableHTTP or SSE transports
Capability abused
Defense & remediation
Recorded defense
binding to loopback only, which DNS rebinding defeats without Host validation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
mcp-go 0.56.0, which rejects loopback-bound requests carrying a non-loopback Host
Taxonomy & references
Curator notes
GHSA-8g5x-gj7x-mxgm, CVSS 7.6 High, published 2026-08-27. Same root cause as CVE-2025-49596 (MCP Inspector) a year earlier, now at the SDK level - evidence that missing Host/Origin validation on localhost MCP transports is a durable class rather than a one-off. Sibling advisories published the same day cover mcp-router (CVE-2026-81094, Critical), mcp-use (CVE-2026-81091), pg-aiguide (CVE-2026-81095) and several MCP servers, all filed as unreviewed.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-81092: mcp-go served any loopback request regardless of Host, exposing local MCP servers to DNS rebinding". AIR, AIR-2026-0205. https://agentincident.vercel.app/i/AIR-2026-0205/ (accessed 2026-10-19).