CVE-2026-123272 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
mcp-go is a Go library for building Model Context Protocol clients and servers. Before v1.2.1, its OAuth handler accepts a resource indicator declared in a server's well-known metadata without checking it, so a malicious MCP server can get tokens minted for a different MCP server and replay them against that server.
first public Oct 9, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use mcp-go's OAuth handler to connect to remote MCP servers are exposed, because a malicious server can obtain tokens meant for other resources. Applications that only run local MCP servers, or that never use OAuth with MCP servers, are unlikely to be affected. Teams that connect only to trusted servers face lower risk.
Not affected if local-only-servers, no-oauth-client, trusted-servers-only
Who cares go, mcp, mcp-go, oauth
go.mod or with go list -m github.com/mark3labs/mcp-gov1.2.1 or laterMark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.