Skip to content
OpenAdvisories

Vendor

mark3labs

3 known vulnerabilities.

Products

mcp-go 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.0
    CVE-2026-123272

    mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata

    Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can decl…

    mark3labs mcp-go
  • High 7.5
    CVE-2026-108859

    mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering

    mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST req…

    mark3labs mcp-go