Origin validation error in mcp-go lets malicious servers obtain tokens
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-346.
Summary
The mark3labs mcp-go package from v0.48.0 before v1.2.1 does not validate the resources declared in well-known protected resource metadata, which is an origin validation error (CWE-346). A malicious MCP server can declare a different MCP server as the RFC 8707 resource indicator, so the authorization server issues tokens that the attacker can replay against that other server. The attack requires a malicious MCP server and some user interaction, and no exploitation is reported.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade mcp-go to v1.2.1 or later. Red Hat lists Red Hat Connectivity Link 1, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI) and Red Hat OpenShift distributed tracing 3 as affected without a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA mcp-go (mark3labs) Fixed in v1.2.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Connectivity Link 1 | Affected | — |
| Red Hat Hardened Images | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift distributed tracing 3 | Affected | — |
Timeline
- 2026-11-05 Threatist record created from CVE-2026-123272
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Alias added: GHSA-h3x9-8c36-m89w
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-08 Affected versions changed · CNA
References
Patch 2
More mark3labs vulnerabilities
- TI-2026-70749 mcp-go Denial of Service via Unbounded POST Body Buffering CVSS 4.0HIGH 8.7
- TI-2026-56054 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding CVSS 4.0HIGH 7.6
Sources
- CVE-2026-123272 · CVE Program
- CVE-2026-123272 · NVD
- FIRST EPSS
- GHSA-h3x9-8c36-m89w · GitHub Advisory Database · CC BY 4.0
- CVE-2026-123272 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences