{"id":"CVE-2026-123272","kind":"vulnerability","aliases":["CVE-2026-123272"],"related":[],"title":"mcp-go: OAuth metadata check lets malicious MCP servers obtain other servers' tokens","description":"Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.","summary":"mcp-go is a Go library for building Model Context Protocol clients and servers. Before v1.2.1, its OAuth handler accepts a resource indicator declared in a server's well-known metadata without checking it, so a malicious MCP server can get tokens minted for a different MCP server and replay them against that server.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","go","mcp","mcp-go","oauth"],"not_affected_if":["local-only-servers","no-oauth-client","trusted-servers-only"],"how_to_check":"- Find the mcp-go version in `go.mod` or with `go list -m github.com/mark3labs/mcp-go`\n- Check whether the code uses the OAuth client flow (OAuthHandler) to connect to remote MCP servers\n- Confirm whether the application connects to MCP servers that are not fully trusted","fix":"- mcp-go: upgrade to `v1.2.1` or later","status":"open","published_at":"2026-11-05T19:17:20+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","triaged_at":"2026-11-05T19:42:57+00:00","updated_at":"2026-11-05T19:42:57+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-05T19:42:57Z","model":"claude-haiku-5-5","output":{"fix":"- mcp-go: upgrade to `v1.2.1` or later","reach":"network","title":"mcp-go: OAuth metadata check lets malicious MCP servers obtain other servers' tokens","impact":"high","summary":"mcp-go is a Go library for building Model Context Protocol clients and servers. Before v1.2.1, its OAuth handler accepts a resource indicator declared in a server's well-known metadata without checking it, so a malicious MCP server can get tokens minted for a different MCP server and replay them against that server.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","go","mcp-go","oauth"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker replays stolen tokens against another MCP server","analyst_note":"Confirm the exact fixed version and whether user interaction is required, using the NVD and vendor advisory links.","how_to_check":"- Find the mcp-go version in `go.mod` or with `go list -m github.com/mark3labs/mcp-go`\n- Check whether the code uses the OAuth client flow (OAuthHandler) to connect to remote MCP servers\n- Confirm whether the application connects to MCP servers that are not fully trusted","plain_action":"","needs_analyst":true,"not_affected_if":["no-oauth-client","local-only-servers","trusted-servers-only"],"who_is_affected":"Applications that use mcp-go's OAuth handler to connect to remote MCP servers are exposed, because a malicious server can obtain tokens meant for other resources. Applications that only run local MCP servers, or that never use OAuth with MCP servers, are unlikely to be affected. Teams that connect only to trusted servers face lower risk.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000759,"input_tokens":4345,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123272':17A,20A '-2026':16A,19A '8707':129C 'accept':50B 'ai':22B 'ai-tool':21B 'allow':100C 'arbitrari':112C 'attack':119C,140C 'author':134C 'build':38B 'caus':132C 'check':6A,64B 'client':42B 'contain':92C 'context':40B 'cve':15A,18A 'declar':54B,111C,121C 'differ':77B,123C 'get':72B 'go':3A,24B,28B,32B,35B,89C 'handler':49B 'improp':94C 'indic':53B,131C 'known':61B,117C 'let':7A 'librari':36B 'malici':8A,68B,101C 'mark3labs':86C 'mcp':2A,9A,25B,27B,31B,69B,78B,88C,102C,124C 'mcp-go':1A,26B,30B,87C 'metadata':5A,62B,118C 'mint':74B,137C 'model':39B 'oauth':4A,29B,48B 'oauthhandler.fetchservermetadata':98C 'obtain':11A,105C 'protocol':41B 'replay':81B,141C 'resourc':52B,109C,113C,130C,144C 'rfc':128C 'server':10A,13A,44B,57B,70B,79B,85B,103C,125C,135C 'token':14A,73B,106C,138C 'tool':23B 'v1.2.1':46B,91C 'valid':95C 'vulner':96C 'well':60B,116C 'well-known':59B,115C 'without':63B","nicknames":[],"mitigations":[],"who_affected":"Applications that use mcp-go's OAuth handler to connect to remote MCP servers are exposed, because a malicious server can obtain tokens meant for other resources. Applications that only run local MCP servers, or that never use OAuth with MCP servers, are unlikely to be affected. Teams that connect only to trusted servers face lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","go","high","mcp","mcpgo","oauth"],"campaign_type":null,"first_public_at":"2026-10-09T09:02:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123272","severity":null,"published_at":"2026-11-05T19:17:20+00:00","modified_at":"2026-11-05T19:17:20+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","fetched_at":"2026-11-05T19:40:36+00:00","note":null}],"documents":[{"id":79219,"url":"https://github.com/mark3labs/mcp-go/commit/90d247ed8d45cbb7d71d9a95e112789b78760443","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79220,"url":"https://github.com/mark3labs/mcp-go/releases/tag/v1.2.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79221,"url":"https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-09T09:02:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":79222,"url":"https://www.vulncheck.com/advisories/mcp-go-before-1.2.1-origin-validation-error-via-unvalidated-well-known-protected-resource-metadata","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}