mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched) · updates https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911 mark3labs/mcp-go's MCPServer.HandleMessage decodes JSON-RPC with encoding/json, which matches member names case-insensitively, folds ſ (U+017F) to s and K (U+212A) to k, and keeps the last of duplicate members. A request with Method/METHOD/paramſ, or with method given twice, still runs as the named call. mcp-go does not authorize calls itself, so this matters when a gateway or proxy in front allowlists method / params.name with an exact-match parser: the proxy may not see the call the server executes. The official Model Context Protocol Go SDK had the same class of bug (CVE-2026-27896 / GHSA-wvj2-96wp-fq3f) and fixed it in 1.3.1. Reported privately to contact@mark3labs.com on 2026-08-16 with no reply, then disclosed. Affected through v1.5.0 (tested on v1.0.0-beta.1, v1.4.0 and main after v1.5.0); no fix released. Workarounds: reject messages whose member names are not exactly the defined ones or that repeat a member, or re-encode before forwarding. en Wed, 04 Nov 2026 00:00:00 GMT mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched): golang/vulndb#6911 opened describing the mcp-go JSON-RPC case/Unicode-folding proxy-allowlist bypass; fixed in: not fixed. https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911 https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911#2026-11-04-45f88efd Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/golang/vulndb/issues/6911">Source</a></p> mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched): Public disclosure filed as mark3labs/mcp-go#1164 after private report and follow-up went unanswered. https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911 https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911#2026-11-04-9a3facf7 Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/mark3labs/mcp-go/issues/1164">Source</a></p> mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched): Issue reported privately to contact@mark3labs.com; no reply (per public disclosure). https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911 https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911#2026-08-16-d3173d20 Sun, 16 Aug 2026 00:00:00 GMT high <p><a href="https://github.com/mark3labs/mcp-go/issues/1164">Source</a></p>