CVE-2026-123272 | Mark3 Labs mcp-go up to 1.2.0 OAuth Metadata OAuthHandler.fetchServerMetadata input validation

November 5, 2026 Yanac

A vulnerability has been found in Mark3 Labs mcp-go up to 1.2.0 and classified as critical. Impacted is the function OAuthHandler.fetchServerMetadata of the component OAuth Metadata Handler. This manipulation causes improper input validation.

This vulnerability appears as CVE-2026-123272. The attack may be initiated remotely. There is no available exploit.

The affected component should be upgraded.VulDB Recent EntriesRead More