cve.bz

mark3labs mcp-go vulnerabilities, newest first

Filter
  1. 5.1CVE-2026-123272EPSS 0.2%

    Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata…

  2. 8.7CVE-2026-108859EPSS 0.5%

    mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many…

  3. 7.6CVE-2026-81092EPSS 0.2%

    mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection r…