{"id":"CVE-2026-27896","title":"modelcontextprotocol/go-sdk: improper handling of case sensitivity (CVE-2026-27896)","summary":"A flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 …","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":["CWE-178","CWE-436"],"vendor":"Red Hat","product":"Migration Toolkit for Virtualization","affected":["migration_toolkit_for_virtualization","openshift_lightspeed","openshift_serverless","openshift_ai_rhoai"],"published":"2026-02-26","updated":"2026-10-15","sourceUpdated":"2026-10-15T10:46:37+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-27896"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442903"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27896"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27896"},{"url":"https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0"},{"url":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00292,"epssPercentile":0.21657,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-02-26T17:06:14.973622Z"},"scores":{"vendor":7.2,"cna":7},"ingestedAt":"2026-09-16T12:55:21.866Z","slug":"CVE-2026-27896","body":"## Overview\n\nA flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 specification, which explicitly requires case-sensitive field name matching. A malicious MCP peer able to send protocol messages with non-standard field casing can potentially bypass intermediary inspection, allowing attackers to smuggle payloads past upstream filters and cause cross-implementation inconsistency.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Virtualization, OpenShift Lightspeed, OpenShift Serverless, Red Hat OpenShift AI (RHOAI) · no fix planned: Migration Toolkit for Virtualization, Red Hat OpenShift AI (RHOAI), OpenShift Lightspeed, OpenShift Serverless · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json)\n\n**modelcontextprotocol/go-sdk: improper handling of case sensitivity** — rated Important by Red Hat. Released 2026-02-26, updated 2026-10-15.\n\nAffected:\n\n- Migration Toolkit for Virtualization\n- OpenShift Lightspeed\n- OpenShift Serverless\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Migration Toolkit for Virtualization\n- Red Hat OpenShift AI (RHOAI)\n- OpenShift Lightspeed\n- OpenShift Serverless\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- To mitigate this flaw, strictly enforce JSON-RPC case sensitivity before payload processing or harden upstream WAF and proxy rules to explicitly block improperly cased requests at the network edge.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222231,"id":"CVE-2026-27896","ts":1792065123765,"field":"cvss","old":"7","new":"7.2"}]}