GHSA-xf6j-693p-wqxx: mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata

Published Nov 5, 2026

Updated

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.

Event History

Nov 5, 2026

CVE Published

via OSV·06:45 PM

Data Sourced

via OSV·06:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Mark3labs mcp-go before v1.2.1 are affected when the OAuth handler fetches protected resource metadata from an MCP server that can declare arbitrary resource values.

What does an attacker need to exploit this?

An attacker needs to operate or control a malicious MCP server and have it declare a different MCP server as the RFC 8707 resource indicator in well-known metadata. The attack also requires user interaction, as reflected by the UI:A vector.

What is the likely impact of successful exploitation?

The authorization server can mint a token for another resource, which the malicious server can replay against that resource. The stated impact is on the confidentiality and integrity of the subsequent system, not the vulnerable component itself.

What should be done if patching is not immediately possible?

Avoid using OAuth flows with untrusted MCP servers whose well-known protected resource metadata can declare arbitrary resources. Restrict MCP server trust to servers whose metadata and intended resource are controlled and validated.

GHSA-xf6j-693p-wqxx: mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the likely impact of successful exploitation?

What should be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the likely impact of successful exploitation?

What should be done if patching is not immediately possible?