---
id: CVE-2026-27896
title: >-
  modelcontextprotocol/go-sdk: improper handling of case sensitivity
  (CVE-2026-27896)
summary: >-
  A flaw was found in the Go MCP SDK. This issue occurs due to an improper
  handling of case sensitivity during JSON-RPC message parsing, specifically in
  the matching of JSON keys to struct field tags. This behavior violates the
  JSON-RPC 2.0 …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-178
  - CWE-436
vendor: Red Hat
product: Migration Toolkit for Virtualization
affected:
  - migration_toolkit_for_virtualization
  - openshift_lightspeed
  - openshift_serverless
  - openshift_ai_rhoai
published: '2026-02-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:46:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-27896'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2442903'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-27896'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27896'
  - url: >-
      https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0
  - url: >-
      https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00292
epssPercentile: 0.21657
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-02-26T17:06:14.973622Z'
scores:
  vendor: 7.2
  cna: 7
ingestedAt: '2026-09-16T12:55:21.866Z'
---

## Overview

A flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 specification, which explicitly requires case-sensitive field name matching. A malicious MCP peer able to send protocol messages with non-standard field casing can potentially bypass intermediary inspection, allowing attackers to smuggle payloads past upstream filters and cause cross-implementation inconsistency.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Migration Toolkit for Virtualization, OpenShift Lightspeed, OpenShift Serverless, Red Hat OpenShift AI (RHOAI) · no fix planned: Migration Toolkit for Virtualization, Red Hat OpenShift AI (RHOAI), OpenShift Lightspeed, OpenShift Serverless · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json)

**modelcontextprotocol/go-sdk: improper handling of case sensitivity** — rated Important by Red Hat. Released 2026-02-26, updated 2026-10-15.

Affected:

- Migration Toolkit for Virtualization
- OpenShift Lightspeed
- OpenShift Serverless
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Migration Toolkit for Virtualization
- Red Hat OpenShift AI (RHOAI)
- OpenShift Lightspeed
- OpenShift Serverless

## Remediation

Will not fix

Workarounds / mitigations:

- To mitigate this flaw, strictly enforce JSON-RPC case sensitivity before payload processing or harden upstream WAF and proxy rules to explicitly block improperly cased requests at the network edge.