Skip to content
OpenAdvisories

Package · Go

github.com/mark3labs/mcp-go

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Unscored —
    GO-2026-6911

    SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go

    In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer…

    github.com/mark3labs/mcp-go Go