Is your Go MCP server open to DNS rebinding? Check v1.4.0
CVE-2026-34742: Go MCP SDK before 1.4.0 accepts any Host header on localhost HTTP servers. We tested v1.3.1, v1.4.0 and v1.8.0, and show the fix and a proxy trap.
Sat Oct 17 2026 · 9 min read · 0 views