Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: mark3labs Clear all filters
TI-2026-85606 CVE-2026-123272 · GHSA-h3x9-8c36-m89w

Origin validation error in mcp-go lets malicious servers obtain tokens

Priority LOW 25

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00196 Published 2026-11-05 Partial fix · v1.2.1 CWE-346
TI-2026-70749 CVE-2026-108859 · GHSA-c673-ppxx-9wvj

mcp-go Denial of Service via Unbounded POST Body Buffering

Priority MEDIUM 44

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00545 Published 2026-10-11 Partial fix CWE-770