CVE-2026-34742 affects the official Go MCP SDK before version 1.4.0: HTTP servers did not check the Host header, so a malicious web page could reach a localhost MCP server through DNS rebinding.
In our test, SDK v1.3.1 answered a request with the Host header `attacker.example` with HTTP 200, while v1.4.0 and v1.8.0 answered with HTTP 403.
Stdio servers are not affected. The risk is a `StreamableHTTPHandler` or `SSEHandler` on localhost with no authentication.
The upgrade has one trap: a reverse proxy on the same machine that forwards a public hostname now gets 403 too.