High 7.0Published Feb 25, 2026

CVE-2026-27896MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

Updated under an hour ago (Oct 27, 2026, 5:40 AM ET)

Does this affect you?

It affects modelcontextprotocol go-sdk and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for modelcontextprotocol go-sdk

Exploited in the last 30 days

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.

CVSS: 7.0 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness (CWE): CWE-178, CWE-436
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

modelcontextprotocol go-sdk modelcontextprotocol:go_sdk (from the name)	before 1.3.1	CNA record
Red Hat Migration Toolkit for Virtualization redhat:migration_toolkit_virtualization	2	CISA ADP
Red Hat OpenShift Lightspeed redhat:openshift_lightspeed	All versions	CISA ADP
Red Hat OpenShift Serverless redhat:serverless	1	CISA ADP
Red Hat Red Hat OpenShift AI (RHOAI) redhat:openshift_ai	All versions	CISA ADP
lfprojects mcp_go_sdk lfprojects:mcp_go_sdk	before 1.3.1	NVD

References

References

https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f	x-refsource-confirm, patch, vendor-advisory
https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0	x-refsource-misc, patch
https://access.redhat.com/security/cve/CVE-2026-27896
https://bugzilla.redhat.com/show_bug.cgi?id=2442903
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.