Improper Validation in OAuthHandler.fetchServerMetadata in Mark3labs Product
CVE-2026-123272

5.1MEDIUM

Key Information:

Vendor

Mark3labs

Status
Mcp-go
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123272?

The mcp-go product by Mark3labs is affected by an improper validation vulnerability in the OAuthHandler.fetchServerMetadata function. This flaw allows malicious Managed Cloud Platforms (MCP) to obtain tokens for unauthorized resources by declaring arbitrary resources in well-known metadata. Attackers can manipulate the resource indicator to impersonate another MCP server, leading the authorization server to issue tokens that can be misused against those resources. This vulnerability highlights the importance of strict validation checks in the management of OAuth tokens to prevent unauthorized access and exploitation.

Affected Version(s)

mcp-go v0.48.0

References

https://github.com/mark3labs/mcp-go/security/advisories/G...
vendor-advisory
https://github.com/mark3labs/mcp-go/pull/1053
issue-trackingpatch
https://github.com/mark3labs/mcp-go/commit/90d247ed8d45cb...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Theodoros Lampropoulos
Ed Zynda (ezynda3)
.