{"schemaVersion":3,"id":"CVE-2026-27896","aliases":["CGA-386h-5wwm-gp66","CGA-4c2w-xvgh-pp2c","CGA-4pr4-gxph-v773","CGA-4vh9-3h7f-r2fh","CGA-53r3-vqp5-6h7p","CGA-5w25-rhwg-3673","CGA-8366-6q5v-hq96","CGA-9j73-75gq-8w5j","CGA-c3rw-8vr2-w3r7","CGA-fv79-7gjm-x4wr","CGA-gj8p-r5g3-rq2g","CGA-h42x-h7j9-4qxp","CGA-h9hv-v6wg-77wr","CGA-hpgf-v576-cpm2","CGA-jxc3-v49r-mpxq","CGA-mxgv-fr8g-789p","CGA-qmgv-h3g4-mhhh","CGA-rv6c-6x8c-548f","CGA-v3pc-hqfh-j2mm","CGA-v86x-qm8c-xv5g","CGA-vjh4-xfhg-gg3v","CGA-wc5w-wq9c-87rq","CGA-wg9w-gg57-wh7w","GHSA-wvj2-96wp-fq3f","GO-2026-4569","CGA-26cp-c6qh-67rx","CGA-2x6c-2jvp-f3vp","CGA-34wp-2c4c-7q44","CGA-4h7g-grr2-ggcr","CGA-53fc-m6vw-68vr","CGA-53jq-qm7g-p6jx","CGA-558x-x2rr-f9q8","CGA-5h6f-c2qc-8xh9","CGA-5r43-q3jf-cf4q","CGA-67wx-gvxj-hqp2","CGA-75ff-9rxc-j6pc","CGA-7m26-g8jp-h48j","CGA-7pxg-f7fp-688h","CGA-83w5-hm78-hr9r","CGA-8mcp-wf3r-628v","CGA-9wc9-34fx-wjv9","CGA-cg78-256g-2cjc","CGA-f5mf-x39w-q52x","CGA-fx25-m7jq-3q5h","CGA-g46q-89rf-q74m","CGA-gw2r-6jcv-55x6","CGA-hcp5-hj38-vhpr","CGA-hhf3-w698-2gvq","CGA-mvm4-hwf2-77qw","CGA-pgx5-pwjw-74mq","CGA-pwm6-4c7q-jg2q","CGA-pxm4-r8wf-hpvw","CGA-q2h5-h5mg-pq64","CGA-qqc2-74pr-7mc3","CGA-rcf2-72hp-mrgv","CGA-v5hc-6mvw-qqp8","CGA-wfq6-5m6q-crwq","CGA-wxvx-ch5h-22p3","CGA-x8pc-973h-37qp","CGA-xw62-x6xj-q246"],"status":"published","duplicateOf":null,"title":null,"description":"The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:\"method\" would also match \"Method\", \"METHOD\", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.","dates":{"published":"2026-02-26T00:47:46.967Z","modified":"2026-09-16T12:04:21.685Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.2,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00467,"percentile":0.39092,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.21199999999999994,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00255},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0044,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00467,"percentile":0.39092}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0044,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00457,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00467,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00467,"percentile":0.39092}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-178","name":"Improper Handling of Case Sensitivity","description":"The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/178.html"},{"id":"CWE-436","name":"Interpretation Conflict","description":"Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/436.html"}],"affected":[{"vendor":"chainguard","product":"datadog-cluster-agent-7.75","name":"datadog-cluster-agent-7.75","label":"datadog-cluster-agent-7.75","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-cluster-agent-7.75","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-cluster-agent-7.76","name":"datadog-cluster-agent-7.76","label":"datadog-cluster-agent-7.76","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-cluster-agent-7.76","purlType":"apk","versions":[{"text":"< 7.76.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.76.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-cluster-agent-fips-7.75","name":"datadog-cluster-agent-fips-7.75","label":"datadog-cluster-agent-fips-7.75","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-cluster-agent-fips-7.75","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-cluster-agent-fips-7.76","name":"datadog-cluster-agent-fips-7.76","label":"datadog-cluster-agent-fips-7.76","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-cluster-agent-fips-7.76","purlType":"apk","versions":[{"text":"< 7.76.1-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.76.1-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ferretdb","name":"ferretdb","label":"ferretdb","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ferretdb","purlType":"apk","versions":[{"text":"< 2.7.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.0-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-operator-mcp","name":"flux-operator-mcp","label":"flux-operator-mcp","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-operator-mcp","purlType":"apk","versions":[{"text":"< 0.43.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.43.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"flux-operator-mcp-fips","name":"flux-operator-mcp-fips","label":"flux-operator-mcp-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/flux-operator-mcp-fips","purlType":"apk","versions":[{"text":"< 0.41.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.41.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"github-mcp-server","name":"github-mcp-server","label":"github-mcp-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/github-mcp-server","purlType":"apk","versions":[{"text":"< 0.31.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.31.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-18.6","name":"gitlab-workhorse-ce-18.6","label":"gitlab-workhorse-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-18.7","name":"gitlab-workhorse-ce-18.7","label":"gitlab-workhorse-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-18.7","purlType":"apk","versions":[{"text":"< 18.7.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.7.5-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-18.8","name":"gitlab-workhorse-ce-18.8","label":"gitlab-workhorse-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-18.8","purlType":"apk","versions":[{"text":"< 18.8.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.8.5-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-18.9","name":"gitlab-workhorse-ce-18.9","label":"gitlab-workhorse-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-18.9","purlType":"apk","versions":[{"text":"< 18.9.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-fips-18.6","name":"gitlab-workhorse-ce-fips-18.6","label":"gitlab-workhorse-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-fips-18.7","name":"gitlab-workhorse-ce-fips-18.7","label":"gitlab-workhorse-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.7","purlType":"apk","versions":[{"text":"< 18.7.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.7.5-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-fips-18.8","name":"gitlab-workhorse-ce-fips-18.8","label":"gitlab-workhorse-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.8","purlType":"apk","versions":[{"text":"< 18.8.5-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.8.5-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-workhorse-ce-fips-18.9","name":"gitlab-workhorse-ce-fips-18.9","label":"gitlab-workhorse-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gptscript","name":"gptscript","label":"gptscript","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gptscript","purlType":"apk","versions":[{"text":"< 0.9.8-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.8-r35","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-all-in-one","name":"jaeger-2-all-in-one","label":"jaeger-2-all-in-one","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-all-in-one","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-collector","name":"jaeger-2-collector","label":"jaeger-2-collector","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-collector","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-fips-all-in-one","name":"jaeger-2-fips-all-in-one","label":"jaeger-2-fips-all-in-one","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-fips-all-in-one","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-fips-collector","name":"jaeger-2-fips-collector","label":"jaeger-2-fips-collector","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-fips-collector","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-fips-ingester","name":"jaeger-2-fips-ingester","label":"jaeger-2-fips-ingester","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-fips-ingester","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-fips-jaeger","name":"jaeger-2-fips-jaeger","label":"jaeger-2-fips-jaeger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-fips-jaeger","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-fips-query","name":"jaeger-2-fips-query","label":"jaeger-2-fips-query","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-fips-query","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-ingester","name":"jaeger-2-ingester","label":"jaeger-2-ingester","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-ingester","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-jaeger","name":"jaeger-2-jaeger","label":"jaeger-2-jaeger","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-jaeger","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jaeger-2-query","name":"jaeger-2-query","label":"jaeger-2-query","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jaeger-2-query","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opencost","name":"opencost","label":"opencost","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opencost","purlType":"apk","versions":[{"text":"< 1.119.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.119.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opencost-fips","name":"opencost-fips","label":"opencost-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opencost-fips","purlType":"apk","versions":[{"text":"< 1.119.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.119.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"osv-scanner","name":"osv-scanner","label":"osv-scanner","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/osv-scanner","purlType":"apk","versions":[{"text":"< 2.3.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.3.3-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-cluster-agent-7.75","name":"datadog-cluster-agent-7.75","label":"datadog-cluster-agent-7.75","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-cluster-agent-7.75","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"datadog-cluster-agent-7.76","name":"datadog-cluster-agent-7.76","label":"datadog-cluster-agent-7.76","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/datadog-cluster-agent-7.76","purlType":"apk","versions":[{"text":"< 7.76.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.76.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ferretdb","name":"ferretdb","label":"ferretdb","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ferretdb","purlType":"apk","versions":[{"text":"< 2.7.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.0-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"github-mcp-server","name":"github-mcp-server","label":"github-mcp-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/github-mcp-server","purlType":"apk","versions":[{"text":"< 0.31.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.31.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"gptscript","name":"gptscript","label":"gptscript","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/gptscript","purlType":"apk","versions":[{"text":"< 0.9.8-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.8-r35","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jaeger-2-all-in-one","name":"jaeger-2-all-in-one","label":"jaeger-2-all-in-one","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jaeger-2-all-in-one","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jaeger-2-collector","name":"jaeger-2-collector","label":"jaeger-2-collector","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jaeger-2-collector","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jaeger-2-ingester","name":"jaeger-2-ingester","label":"jaeger-2-ingester","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jaeger-2-ingester","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jaeger-2-jaeger","name":"jaeger-2-jaeger","label":"jaeger-2-jaeger","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jaeger-2-jaeger","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jaeger-2-query","name":"jaeger-2-query","label":"jaeger-2-query","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jaeger-2-query","purlType":"apk","versions":[{"text":"< 2.15.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opencost","name":"opencost","label":"opencost","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opencost","purlType":"apk","versions":[{"text":"< 1.119.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.119.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"osv-scanner","name":"osv-scanner","label":"osv-scanner","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/osv-scanner","purlType":"apk","versions":[{"text":"< 2.3.3-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.3.3-r2","eol":null,"hubHref":null},{"vendor":"github.com/modelcontextprotocol","product":"go-sdk","name":"github.com/modelcontextprotocol/go-sdk","label":"go-sdk","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/modelcontextprotocol/go-sdk","purlType":"golang","versions":[{"text":"< 1.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.1","eol":null,"hubHref":null},{"vendor":"lfprojects","product":"mcp_go_sdk","name":"mcp go sdk","label":"mcp_go_sdk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.1","eol":null,"hubHref":"/vendor/lfprojects/mcp_go_sdk"},{"vendor":"modelcontextprotocol","product":"go-sdk","name":"go-sdk","label":"go-sdk","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.1","eol":null,"hubHref":"/vendor/modelcontextprotocol/go-sdk"}],"affectedCount":45,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f","label":"github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Patch","Vendor Advisory"]},{"url":"https://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0","label":"github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27896","label":"access.redhat.com/security/cve/CVE-2026-27896","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2442903","label":"bugzilla.redhat.com/show_bug.cgi?id=2442903","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json","label":"security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27896.json","hostname":"security.access.redhat.com","tags":["X Sadp Csaf Vex","WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27896.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27896.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27896","label":"nvd.nist.gov/vuln/detail/CVE-2026-27896","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/modelcontextprotocol/go-sdk","label":"github.com/modelcontextprotocol/go-sdk","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:21483-1","SUSE-SU-2026:1042-1"],"duplicates":[],"related":["CGA-VFRX-695V-7WQ5","OPENSUSE-SU-2026:21483-1","SUSE-SU-2026:1042-1"]},"timeline":[{"kind":"published","date":"2026-02-26T00:47:46.967Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-16T12:04:21.685Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:32:34.006Z","stale":false,"partial":false}}