CyberSecBulletin

Mark3labs vulnerabilities

We track 2 vulnerabilities in Mark3labs products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.

2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score

Latest Mark3labs vulnerabilities

  • 8.0 High severity

    mcp-go: Origin Validation Error

    CVE-2026-123272Mark3labs

    Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can decla

  • 7.5 High severity

    mcp-go: Allocation of Resources Without Limits or Throttling

    CVE-2026-108859Mark3labs

    mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requ