mark3labs

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

mark3labs records in CISA KEV

No mark3labs vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-70749 CVE-2026-108859 · GHSA-c673-ppxx-9wvj

mcp-go Denial of Service via Unbounded POST Body Buffering

MEDIUM 44

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00545 Published 2026-10-11 Partial fix CWE-770

TI-2026-56054 CVE-2026-81092 · GHSA-8g5x-gj7x-mxgm

mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

LOW 33

mcp-go accepted requests on its HTTP transports without checking the Host header.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00223 Published 2026-08-27 Partial fix · 0.56.0 CWE-346

TI-2026-85606 CVE-2026-123272 · GHSA-h3x9-8c36-m89w

Origin validation error in mcp-go lets malicious servers obtain tokens

LOW 25

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00196 Published 2026-11-05 Partial fix · v1.2.1 CWE-346

Open these records in search →

Critical	0
High	2
Medium	1
Low	0
No CVSS	0