---
id: "GO-2026-6911"
page: "https://infrastack.ai/live/GO-2026-6911"
kind: "vulnerability"
aliases: ["GO-2026-6911"]
title: "SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/mark3labs/mcp-go", "fixed": [], "affected": "all versions (client/transport, NewStreamableHTTP)", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["credential-leak", "go", "mcp", "mcp-go", "oauth", "package", "ssrf"]
not_affected_if: ["custom-http-client", "no-custom-headers", "no-oauth", "stdio-only", "trusted-server-only"]
published_at: "2026-11-05T22:55:15+00:00"
first_seen_at: "2026-11-06T00:09:14+00:00"
updated_at: "2026-11-06T00:11:33+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6911", "first_seen_at": "2026-11-06T00:09:14+00:00"}, {"source": "analyst", "url": "https://pkg.go.dev/vuln/GO-2026-6911", "first_seen_at": "2026-11-06T00:11:33+00:00", "cites": ["https://pkg.go.dev/vuln/GO-2026-6911", "https://github.com/mark3labs/mcp-go/issues/1164"]}]
exploit_sources: []
---

# SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go

Link for people: https://infrastack.ai/live/GO-2026-6911 (this .md is for agents)

The Go MCP client library mcp-go follows HTTP redirects to any host or scheme when no custom HTTP client is supplied. It also sends configured custom headers and OAuth bearer tokens to the redirect target, so a malicious or compromised MCP server can capture credentials and reach internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/mark3labs/mcp-go affected all versions (client/transport, NewStreamableHTTP) fixed no fixed version listed

## How to check

- Run: go list -m github.com/mark3labs/mcp-go (or grep go.mod). Any version is listed as affected.
- Search code for NewStreamableHTTP: exposed if it is called without WithHTTPBasicClient (or with a client that has no CheckRedirect restriction) AND you use WithHeaders or OAuth to talk to a server you do not fully control.
- Also check any code that uses StreamableHTTP SendRequest/SendNotification/SetRequestHandler/Close.

## Fix

No fixed version known as of 2026-11-06 (latest release v1.5.0, 30 Oct, predates the report). Until fixed: pass your own client with WithHTTPBasicClient whose CheckRedirect returns http.ErrUseLastResponse or only allows same-origin https; connect only to MCP servers you trust; rotate tokens/headers sent to untrusted servers.

## Timeline

- 2026-11-06T00:09:14+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6911
- 2026-11-06T00:11:33+00:00 analyst https://pkg.go.dev/vuln/GO-2026-6911 — Read Go vulndb entry: all versions affected, no known fix. The entry's reference #1164 in mark3labs/mcp-go is actually a different bug (case-insensitive JSON-RPC member names), so there is no maintainer page on the redirect issue yet; fix-status none rests on the Go vuln DB only, nothing marked verified. Revisit for a fix release/PR.

## Documents

- [advisory] GO-2026-6911 Go vulnerability report https://pkg.go.dev/vuln/GO-2026-6911
- [mentions] mcp-go #1164: JSON-RPC member names matched case-insensitively (referenced by the vuln entry, different bug) https://github.com/mark3labs/mcp-go/issues/1164

## From the sources

In github.com/mark3labs/mcp-go/client/transport, NewStreamableHTTP constructs an http.Client with a nil CheckRedirect policy when no custom WithHTTPBasicClient is supplied, and attaches static custom headers and OAuth bearer tokens inside a RoundTripper layer. If an MCP server responds with a 3xx redirect, the client follows the Location header to arbitrary hosts and schemes and attaches configured WithHeaders and OAuth Authorization headers to the redirected request, enabling server-side request forgery (SSRF) and credential disclosure.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_