cve.bz

CVE-2026-123272

5.1 mediumEPSS 0.2%

Medium (5.1) in mark3labs mcp-go. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.

On this page
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.

Severity

CVSS 4.0

5.1 medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

8.0 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS
0.2% estimated probability of exploitation activity in the next 30 days; 9th percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
CISA's assessment (SSVC)
Exploitation: none · Automatable: no · Technical impact: total, assessed 2026-11-05. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWE
CWE-346 Origin Validation Error
OWASP Top 10
A07:2025 Authentication Failures
Published
Modified
NVD analysis
Deferred: the NVD does not plan to analyze it
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-123272 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-123272?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-123272?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-123272 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
mark3labs mcp-gofrom v0.48.0 before v1.2.1

Red Hat

Red Hat rates this Important.

Red Hat's statement

This vulnerability is rated as Important because an adversarial Model Context Protocol (MCP) server can manipulate client authentication workflows to acquire authorization tokens for unrelated protected resources across trust boundaries. Successful exploitation requires an application or client session to establish a connection with an untrusted or rogue endpoint. In typical Red Hat deployments, clients connect exclusively to vetted, trusted infrastructure, significantly mitigating exposure to unsolicited server responses.

Red Hat's mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-11-06) ---

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce RFC 9728 resource binding in the mcp-go OAuth handler so client metadata flows reject arbitrary RFC 8707 target resource declarations from well-known endpoints: upgrade to mcp-go 1.2.1 (or the corresponding fixed Red Hat builds), which validate that the declared resource URL binds to the addressed MCP server's base URL and reject metadata on mismatch, closing all 2 injection vectors (crafted well-known protected resource metadata, RFC 8707 resource parameter injection). Until patched, this is a concern on client sessions across all platforms connecting to Model Context Protocol (MCP) servers, so Restrict client sessions to strictly vetted and trusted internal MCP endpoints, preventing applications from connecting to untrusted or external rogue servers. As a compensating measure, Enforce an explicit deny-by-default allowlist check on the resource indicator in OAuth metadata to restrict declared target resource URLs. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper origin validation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (medium)

ProductPackageStateAdvisory
Red Hat Connectivity Link 1rhcl-tech-preview/mcp-gateway-rhel9Under investigation
Red Hat Connectivity Link 1rhcl-tech-preview/mcp-gateway-rhel9-operatorUnder investigation
Red Hat Hardened Imagestempo2.10Under investigation
Red Hat Hardened Imagestempo3.0Under investigation
Red Hat OpenShift AI (RHOAI)rhoai/rhai-cli-rhel9Under investigation
Red Hat OpenShift distributed tracing 3rhosdt/tempo-query-rhel9Under investigation
Red Hat OpenShift distributed tracing 3rhosdt/tempo-rhel9Under investigation

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-123272.

Attack patterns (CAPEC)

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits. More on the page of CWE-346 (16).

References

Check your stackJSON