{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123272", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T18:19:12.668Z", "datePublished": "2026-11-05T18:45:36.197Z", "dateUpdated": "2026-11-08T14:01:06.693Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:06.693Z"}, "datePublic": "2026-10-09T00:00:00.000Z", "title": "mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata", "descriptions": [{"lang": "en", "value": "Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Origin Validation Error", "cweId": "CWE-346", "type": "CWE"}]}], "affected": [{"vendor": "mark3labs", "product": "mcp-go", "defaultStatus": "unaffected", "versions": [{"version": "v0.48.0", "lessThan": "v1.2.1", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:golang/github.com/mark3labs/mcp-go", "repo": "https://github.com/mark3labs/mcp-go"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-xf6j-693p-wqxx)"}, {"url": "https://github.com/mark3labs/mcp-go/pull/1053", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/mark3labs/mcp-go/commit/90d247ed8d45cbb7d71d9a95e112789b78760443", "tags": ["patch"]}, {"url": "https://github.com/mark3labs/mcp-go/releases/tag/v1.2.1", "tags": ["release-notes"], "name": "mcp-go v1.2.1 Release Notes"}, {"url": "https://github.com/mark3labs/mcp-go/blob/4cb0d2015f24b669726fd8e5e53fc8c6d3f57abf/client/transport/oauth.go#L799-L821", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/mcp-go-before-1.2.1-origin-validation-error-via-unvalidated-well-known-protected-resource-metadata"}], "credits": [{"lang": "en", "value": "Theodoros Lampropoulos", "type": "finder"}, {"lang": "en", "value": "Ed Zynda (ezynda3)", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:01:43.498683Z", "id": "CVE-2026-123272", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:01:52.297Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T21:01:43.498683Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:01:48.640Z"}}], "cna": {"title": "mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata", "credits": [{"lang": "en", "type": "finder", "value": "Theodoros Lampropoulos"}, {"lang": "en", "type": "remediation developer", "value": "Ed Zynda (ezynda3)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/mark3labs/mcp-go", "vendor": "mark3labs", "product": "mcp-go", "versions": [{"status": "affected", "version": "v0.48.0", "lessThan": "v1.2.1", "versionType": "custom"}], "packageURL": "pkg:golang/github.com/mark3labs/mcp-go", "defaultStatus": "unaffected"}], "datePublic": "2026-10-09T00:00:00.000Z", "references": [{"url": "https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx", "name": "GitHub Security Advisory (GHSA-xf6j-693p-wqxx)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/mark3labs/mcp-go/pull/1053", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/mark3labs/mcp-go/commit/90d247ed8d45cbb7d71d9a95e112789b78760443", "tags": ["patch"]}, {"url": "https://github.com/mark3labs/mcp-go/releases/tag/v1.2.1", "name": "mcp-go v1.2.1 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/mark3labs/mcp-go/blob/4cb0d2015f24b669726fd8e5e53fc8c6d3f57abf/client/transport/oauth.go#L799-L821", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/mcp-go-before-1.2.1-origin-validation-error-via-unvalidated-well-known-protected-resource-metadata", "name": "VulnCheck Advisory: mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "Origin Validation Error"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:06.693Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123272", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:01:06.693Z", "dateReserved": "2026-11-05T18:19:12.668Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T18:45:36.197Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/mark3labs/mcp-go", "product": "mcp-go", "repo": "https://github.com/mark3labs/mcp-go", "vendor": "mark3labs", "versions": [{"lessThan": "v1.2.1", "status": "affected", "version": "v0.48.0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource."}], "id": "CVE-2026-123272", "lastModified": "2026-11-08T14:18:07.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.8, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123272", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:01:43.498683Z", "version": "2.0.3"}}]}, "published": "2026-11-05T19:17:20.713", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/mark3labs/mcp-go/blob/4cb0d2015f24b669726fd8e5e53fc8c6d3f57abf/client/transport/oauth.go#L799-L821"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mark3labs/mcp-go/commit/90d247ed8d45cbb7d71d9a95e112789b78760443"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mark3labs/mcp-go/pull/1053"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mark3labs/mcp-go/releases/tag/v1.2.1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/mcp-go-before-1.2.1-origin-validation-error-via-unvalidated-well-known-protected-resource-metadata"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/mark3labs/mcp-go: mcp-go: Unauthorized access via improper OAuth metadata validation", "id": "2567474", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567474"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.0", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["A flaw was found in mcp-go. A malicious Model Context Protocol (MCP) server can declare arbitrary protected resources within its metadata due to improper validation in the OAuth metadata handler. This flaw allows an attacker to cause the authorization server to issue tokens scoped for unintended services, enabling unauthorized access when the attacker replays those tokens against the target resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123272", "package_state": [{"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Under investigation", "package_name": "rhcl-tech-preview/mcp-gateway-rhel9", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Under investigation", "package_name": "rhcl-tech-preview/mcp-gateway-rhel9-operator", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "tempo2.10", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "tempo3.0", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/rhai-cli-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3", "fix_state": "Under investigation", "package_name": "rhosdt/tempo-query-rhel9", "product_name": "Red Hat OpenShift distributed tracing 3"}, {"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3", "fix_state": "Under investigation", "package_name": "rhosdt/tempo-rhel9", "product_name": "Red Hat OpenShift distributed tracing 3"}], "public_date": "2026-11-05T18:45:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123272\nhttps://github.com/mark3labs/mcp-go/blob/4cb0d2015f24b669726fd8e5e53fc8c6d3f57abf/client/transport/oauth.go#L799-L821\nhttps://github.com/mark3labs/mcp-go/commit/90d247ed8d45cbb7d71d9a95e112789b78760443\nhttps://github.com/mark3labs/mcp-go/pull/1053\nhttps://github.com/mark3labs/mcp-go/releases/tag/v1.2.1\nhttps://github.com/mark3labs/mcp-go/security/advisories/GHSA-xf6j-693p-wqxx\nhttps://www.vulncheck.com/advisories/mcp-go-before-1.2.1-origin-validation-error-via-unvalidated-well-known-protected-resource-metadata"], "statement": "This vulnerability is rated as Important because an adversarial Model Context Protocol (MCP) server can manipulate client authentication workflows to acquire authorization tokens for unrelated protected resources across trust boundaries. Successful exploitation requires an application or client session to establish a connection with an untrusted or rogue endpoint. In typical Red Hat deployments, clients connect exclusively to vetted, trusted infrastructure, significantly mitigating exposure to unsolicited server responses.", "threat_severity": "Important"}