mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched)

mark3labs/mcp-go's MCPServer.HandleMessage decodes JSON-RPC with encoding/json, which matches member names case-insensitively, folds ſ (U+017F) to s and K (U+212A) to k, and keeps the last of duplicate members. A request with Method/METHOD/paramſ, or with method given twice, still runs as the named call. mcp-go does not authorize calls itself, so this matters when a gateway or proxy in front allowlists method / params.name with an exact-match parser: the proxy may not see the call the server executes. The official Model Context Protocol Go SDK had the same class of bug (CVE-2026-27896 / GHSA-wvj2-96wp-fq3f) and fixed it in 1.3.1. Reported privately to contact@mark3labs.com on 2026-08-16 with no reply, then disclosed. Affected through v1.5.0 (tested on v1.0.0-beta.1, v1.4.0 and main after v1.5.0); no fix released. Workarounds: reject messages whose member names are not exactly the defined ones or that repeat a member, or re-encode before forwarding.

Why this severity: Same class as official MCP Go SDK CVE-2026-27896 / GHSA-wvj2-96wp-fq3f (fixed there in 1.3.1). Impact needs a fronting proxy/gateway that allowlists method names with exact-match parsing; unpatched through v1.5.0.

Started

Nov 4, 2026

• Go
• MCP
• #mcp-go
• Auth bypass
• #Proxy bypass