mcp-go vulnerabilities

2 known vulnerabilities in mcp-go from Mark3labs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  mcp-go: Origin Validation Error

  CVE-2026-123272Nov 5, 2026Mark3labs

  Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can decla

• 7.5 High severity

  mcp-go: Allocation of Resources Without Limits or Throttling

  CVE-2026-108859Oct 11, 2026Mark3labs

  mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requ