Advisories · Technology

mark3labs mcp-go.

Every CVE that names mark3labs mcp-go among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-123272 CVE record

CVSS 5.1 Medium

mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
- mark3labs mcp-go
- CWE-346
Not analysed yet 5 Nov 2026
CVE-2026-108859 CVE record

CVSS 8.7 High

mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering
- mark3labs mcp-go
- Denial of service
Not analysed yet 11 Oct 2026
CVE-2026-81092 CVE record

CVSS 7.6 High

mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding
- mark3labs mcp-go
- CWE-346
Not analysed yet 27 Aug 2026