CVE-2026-123272: mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Mark3labs mcp-go before v1.2.1 are affected when they use the vulnerable OAuthHandler.fetchServerMetadata flow and interact with a malicious MCP server.
What does an attacker need to exploit it?
The attacker needs to operate or control a malicious MCP server that can publish well-known protected resource metadata. They declare another MCP server as the RFC 8707 resource indicator, inducing the authorization server to mint a token for that other resource.
What is the impact of a successful exploit?
A malicious MCP server can obtain tokens intended for another resource and replay them against that resource. The provided severity vector indicates network reachability, no privileges required, user interaction required, and high confidentiality and integrity impact.
What version resolves the issue?
Upgrade mcp-go to v1.2.1 or later. The vulnerability affects versions before v1.2.1.