{"id":"GO-2026-6911","kind":"vulnerability","aliases":["GO-2026-6911"],"related":[],"title":"SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go","description":"In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer. If an MCP server responds with a 3xx redirect, the client follows the Location header to arbitrary hosts and schemes and attaches configured WithHeaders and OAuth Authorization headers to the redirected request, enabling server-side request forgery (SSRF) and credential disclosure.","summary":"The Go MCP client library mcp-go follows HTTP redirects to any host or scheme when no custom HTTP client is supplied. It also sends configured custom headers and OAuth bearer tokens to the redirect target, so a malicious or compromised MCP server can capture credentials and reach internal services.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/mark3labs/mcp-go","fixed":[],"affected":"all versions (client/transport, NewStreamableHTTP)","ecosystem":"go"}],"ecosystems":["go"],"tags":["credential-leak","go","mcp","mcp-go","oauth","package","ssrf"],"not_affected_if":["custom-http-client","no-custom-headers","no-oauth","stdio-only","trusted-server-only"],"how_to_check":"- Run: go list -m github.com/mark3labs/mcp-go (or grep go.mod). Any version is listed as affected.\n- Search code for NewStreamableHTTP: exposed if it is called without WithHTTPBasicClient (or with a client that has no CheckRedirect restriction) AND you use WithHeaders or OAuth to talk to a server you do not fully control.\n- Also check any code that uses StreamableHTTP SendRequest/SendNotification/SetRequestHandler/Close.","fix":"No fixed version known as of 2026-11-06 (latest release v1.5.0, 30 Oct, predates the report). Until fixed: pass your own client with WithHTTPBasicClient whose CheckRedirect returns http.ErrUseLastResponse or only allows same-origin https; connect only to MCP servers you trust; rotate tokens/headers sent to untrusted servers.","status":"open","published_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","triaged_at":"2026-11-06T00:10:30+00:00","updated_at":"2026-11-06T00:11:33+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-06T00:10:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"mcp-go: client follows redirects and leaks auth headers to other hosts","impact":"high","summary":"The Go MCP client library mcp-go follows HTTP redirects to any host or scheme when no custom HTTP client is supplied. It also sends configured custom headers and OAuth bearer tokens to the redirect target, so a malicious or compromised MCP server can capture credentials and reach internal services.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","mcp","mcp-go","oauth"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"OAuth tokens and custom headers sent to attacker-chosen hosts","analyst_note":"Confirm the affected and fixed versions for github.com/mark3labs/mcp-go at https://pkg.go.dev/vuln/GO-2026-6911.","how_to_check":"- Check whether `github.com/mark3labs/mcp-go` appears in `go.mod` and at which version.\n- Check whether the code calls `NewStreamableHTTP` without `WithHTTPBasicClient`, and whether it uses `WithHeaders` or OAuth tokens.","plain_action":"","needs_analyst":true,"not_affected_if":["custom-http-client","no-custom-headers","no-oauth"],"who_is_affected":"Applications that use mcp-go's streamable HTTP client to connect to MCP servers, especially with custom headers or OAuth tokens and without supplying their own http.Client. Exposure depends on the client connecting to a server that can return a 3xx redirect, so a team that only talks to a trusted, controlled MCP server is less exposed. The sources do not give the affected version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4331,"output_tokens":639,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the affected and fixed versions for github.com/mark3labs/mcp-go at https://pkg.go.dev/vuln/GO-2026-6911.","search":"'-2026':14A,17A '-6911':15A,18A '/mark3labs/mcp-go':12A,21A '/mark3labs/mcp-go/client/transport,':87C '3xx':123C 'also':57B 'arbitrari':132C 'attach':104C,137C 'author':142C 'bearer':64B,110C 'captur':78B 'checkredirect':95C 'client':36B,53B,126C 'compromis':74B 'configur':59B,138C 'construct':89C 'credenti':3A,23B,79B,156C 'credential-leak':22B 'custom':51B,60B,99C,106C 'disclosur':157C 'enabl':148C 'follow':41B,127C 'forgeri':153C 'github.com':11A,20A,86C 'github.com/mark3labs/mcp-go':10A,19A 'github.com/mark3labs/mcp-go/client/transport,':85C 'go':13A,16A,25B,29B,34B,40B 'header':8A,61B,107C,130C,143C 'host':46B,133C 'http':42B,52B 'http.client':91C 'insid':112C 'intern':82B 'layer':115C 'leak':4A,24B 'librari':37B 'locat':7A,129C 'malici':72B 'mcp':26B,28B,35B,39B,75B,118C 'mcp-go':27B,38B 'newstreamablehttp':88C 'nil':94C 'oauth':30B,63B,109C,141C 'packag':31B 'polici':96C 'reach':81B 'redirect':43B,68B,124C,146C 'request':147C,152C 'respond':120C 'roundtripp':114C 'scheme':48B,135C 'send':58B 'server':76B,119C,150C 'server-sid':149C 'servic':83B 'side':151C 'ssrf':1A,32B,154C 'static':105C 'suppli':55B,102C 'target':69B 'token':65B,111C 'unvalid':6A 'via':5A 'withhead':139C 'withhttpbasiccli':100C","nicknames":[],"mitigations":[],"who_affected":"Go applications and agents that use mcp-go's streamable HTTP client (client/transport NewStreamableHTTP) with the default HTTP client. If the MCP server answers with a 3xx redirect, the client follows it to any host or scheme and sends configured WithHeaders values and OAuth bearer tokens along, so a malicious or compromised MCP server can capture credentials or make the client reach internal services (SSRF). Skip it if you only use stdio/in-process transports, only connect to MCP servers you control, or supply your own HTTP client that blocks redirects.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["githubcommark3labsmcpgo"],"ptokens":["com","github","go","mark3labs","mcp"],"labels":["credentialleak","go","high","mcp","mcpgo","oauth","package","ssrf"],"campaign_type":null,"first_public_at":"2026-11-05T22:55:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6911","url":"https://pkg.go.dev/vuln/GO-2026-6911","severity":null,"published_at":"2026-11-05T22:55:15+00:00","modified_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","fetched_at":"2026-11-06T00:09:14+00:00","note":null},{"source":"analyst","external_id":"GO-2026-6911:1846","url":"https://pkg.go.dev/vuln/GO-2026-6911","severity":null,"published_at":"2026-11-06T00:11:33+00:00","modified_at":"2026-11-06T00:11:33+00:00","first_seen_at":"2026-11-06T00:11:33+00:00","fetched_at":"2026-11-06T00:11:33+00:00","note":"Read Go vulndb entry: all versions affected, no known fix. The entry's reference #1164 in mark3labs/mcp-go is actually a different bug (case-insensitive JSON-RPC member names), so there is no maintainer page on the redirect issue yet; fix-status none rests on the Go vuln DB only, nothing marked verified. Revisit for a fix release/PR.","cites":["https://pkg.go.dev/vuln/GO-2026-6911","https://github.com/mark3labs/mcp-go/issues/1164"]}],"documents":[{"id":81710,"url":"https://pkg.go.dev/vuln/GO-2026-6911","title":"GO-2026-6911 Go vulnerability report","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":81711,"url":"https://github.com/mark3labs/mcp-go/issues/1164","title":"mcp-go #1164: JSON-RPC member names matched case-insensitively (referenced by the vuln entry, different bug)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}