GITHUB.COM/MARK3LABS/MCP-GO · GO-2026-6911 · Package
NO FIX YET · SEE WHAT TO DO
The Go MCP client library mcp-go follows HTTP redirects to any host or scheme when no custom HTTP client is supplied. It also sends configured custom headers and OAuth bearer tokens to the redirect target, so a malicious or compromised MCP server can capture credentials and reach internal services.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Go applications and agents that use mcp-go's streamable HTTP client (client/transport NewStreamableHTTP) with the default HTTP client. If the MCP server answers with a 3xx redirect, the client follows it to any host or scheme and sends configured WithHeaders values and OAuth bearer tokens along, so a malicious or compromised MCP server can capture credentials or make the client reach internal services (SSRF). Skip it if you only use stdio/in-process transports, only connect to MCP servers you control, or supply your own HTTP client that blocks redirects.
Not affected if custom-http-client, no-custom-headers, no-oauth, stdio-only, trusted-server-only
Who cares credential-leak, go, mcp, mcp-go, oauth, ssrf
v1.5.0, 30 Oct, predates the report)In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer. If an MCP server responds with a 3xx redirect, the client follows the Location header to arbitrary hosts and schemes and attaches configured WithHeaders and OAuth Authorization headers to the redirected request, enabling server-side request forgery (SSRF) and credential disclosure.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.