CVE-2026-123272 Details
Description
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.
A vulnerability exists in Mark3labs mcp-go versions 0.48.0 prior to 1.2.1, specifically within the OAuthHandler.fetchServerMetadata function. This vulnerability allows malicious MCP servers to manipulate token requests by declaring arbitrary resources in their well-known metadata. The issue arises because the OAuth client does not properly validate the resource identifiers before using them to request access tokens. As a result, an attacker can have tokens minted for one resource and then replay them against another, potentially leading to unauthorized access.
Users can upgrade to Mark3labs mcp-go version 1.2.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mark3labs mcp-go | >= 0.48.0, <= 1.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | CVE Modified | [email protected] |
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |