Search: CVE-2026-81092

CVE-2026-81092 is a high-severity vulnerability in mark3labs mcp-go prior to version 0.56.0. The software accepted HTTP requests on its loopback interface without validating the Host header, allowing cross-origin requests from browser pages to access local services. This flaw could enable a malicious web page to interact with local servers that assume only local software can connect. Version 0.56.0 introduced validation to reject loopback requests with non-loopback Host headers, mitigating this issue.