# mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched) · pwn.watch

> mark3labs/mcp-go's MCPServer.HandleMessage decodes JSON-RPC with encoding/json, which matches member names case-insensitively, folds ſ (U+017F) to s and K (U+212A) to k, and keeps the last of duplicate members. A request with Method/METHOD/paramſ, or with method given twice, still runs as the named call. mcp-go does not authorize calls itself, so this matters when a gateway or proxy in front allowlists method / params.name with an exact-match parser: the proxy may not see the call the server executes. The official Model Context Protocol Go SDK had the same class of bug (CVE-2026-27896 / GHSA-wvj2-96wp-fq3f) and fixed it in 1.3.1. Reported privately to contact@mark3labs.com on 2026-08-16 with no reply, then disclosed. Affected through v1.5.0 (tested on v1.0.0-beta.1, v1.4.0 and main after v1.5.0); no fix released. Workarounds: reject messages whose member names are not exactly the defined ones or that repeat a member, or re-encode before forwarding.

Page: https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911 · generated 2026-11-06T02:47:11.166Z

## Status
- Severity: high · status: live · patch: unpatched
- Product: mcp-go (github.com/mark3labs/mcp-go)
- Started: 2026-11-04
- Affected: github.com/mark3labs/mcp-go through v1.5.0 (and main after v1.5.0 as of disclosure; earlier versions not all tested)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911/feed.xml
- JSON Feed: https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911.json
- This file: https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911/llms.txt

## Updates (newest first)
- 2026-11-04: golang/vulndb#6911 opened describing the mcp-go JSON-RPC case/Unicode-folding proxy-allowlist bypass; fixed in: not fixed. (https://github.com/golang/vulndb/issues/6911)
- 2026-11-04: Public disclosure filed as mark3labs/mcp-go#1164 after private report and follow-up went unanswered. (https://github.com/mark3labs/mcp-go/issues/1164)
- 2026-08-16: Issue reported privately to contact@mark3labs.com; no reply (per public disclosure). (https://github.com/mark3labs/mcp-go/issues/1164)

## Fix brief
# Security brief: mcp-go: JSON-RPC member-name case/Unicode folding lets calls bypass exact-match proxy allowlists (through v1.5.0, unpatched)

Source: https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911 · status: live · severity: high · updated Nov 6, 2026, 01:14 UTC

## Patch status
**UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.**

## What it is
mark3labs/mcp-go's MCPServer.HandleMessage decodes JSON-RPC with encoding/json, which matches member names case-insensitively, folds ſ (U+017F) to s and K (U+212A) to k, and keeps the last of duplicate members. A request with Method/METHOD/paramſ, or with method given twice, still runs as the named call. mcp-go does not authorize calls itself, so this matters when a gateway or proxy in front allowlists method / params.name with an exact-match parser: the proxy may not see the call the server executes. The official Model Context Protocol Go SDK had the same class of bug (CVE-2026-27896 / GHSA-wvj2-96wp-fq3f) and fixed it in 1.3.1. Reported privately to contact@mark3labs.com on 2026-08-16 with no reply, then disclosed. Affected through v1.5.0 (tested on v1.0.0-beta.1, v1.4.0 and main after v1.5.0); no fix released. Workarounds: reject messages whose member names are not exactly the defined ones or that repeat a member, or re-encode before forwarding.

Severity detail: Same class as official MCP Go SDK CVE-2026-27896 / GHSA-wvj2-96wp-fq3f (fixed there in 1.3.1). Impact needs a fronting proxy/gateway that allowlists method names with exact-match parsing; unpatched through v1.5.0.

- Product: mcp-go (github.com/mark3labs/mcp-go)

## Affected versions
- github.com/mark3labs/mcp-go through v1.5.0 (and main after v1.5.0 as of disclosure; earlier versions not all tested)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Mitigations
The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Specific notes
No vendor fix through v1.5.0. Until a release lands: put an exact-match allowlist proxy in front that rejects non-canonical member names / duplicates, or re-encode JSON-RPC before forwarding. Do not treat pkg.go.dev GO-2026-6911 StreamableHTTP redirect text as describing this issue — the linked vulndb/mcp-go issue bodies are the JSON-RPC case-folding report.

## Latest updates
- Nov 4, 2026: golang/vulndb#6911 opened describing the mcp-go JSON-RPC case/Unicode-folding proxy-allowlist bypass; fixed in: not fixed.
- Nov 4, 2026: Public disclosure filed as mark3labs/mcp-go#1164 after private report and follow-up went unanswered.
- Aug 16, 2026: Issue reported privately to contact@mark3labs.com; no reply (per public disclosure).

## Advisories
- [golang/vulndb#6911: potential Go vuln in github.com/mark3labs/mcp-go (JSON-RPC case folding)](https://github.com/golang/vulndb/issues/6911) (golang/vulndb)
- [mark3labs/mcp-go#1164: JSON-RPC member names matched case-insensitively](https://github.com/mark3labs/mcp-go/issues/1164) (mark3labs/mcp-go)
- [GHSA-wvj2-96wp-fq3f / CVE-2026-27896: same class in official MCP Go SDK (fixed in 1.3.1)](https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f) (modelcontextprotocol/go-sdk)

---
Machine-readable: https://pwn.watch/i/mcp-go-jsonrpc-case-folding-proxy-bypass-go-2026-6911.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.