CVE-2026-123271
Description
A flaw was found in ChatCLI. During the Model Context Protocol (MCP) Open Authorization (OAuth) login process, the application does not verify whether server-supplied resource metadata matches the configured server URL. A malicious MCP server can exploit this issue by specifying a different resource hosted on the same authorization server, allowing it to capture the user's bearer authentication token and replay it to gain unauthorized access to that secondary resource.
Statement
This vulnerability is rated as Important severity because an attacker operating a rogue MCP server can induce the client to forward authentication tokens intended for other protected services sharing the same identity provider, leading to cross-service credential theft. Exploitation requires user interaction to connect to an untrusted endpoint, and ChatCLI is not included in standard Red Hat Enterprise Linux package repositories. The risk is limited to developer workstations where external, unverified Model Context Protocol servers are manually configured.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate server-supplied OAuth metadata and resource indicators against the configured MCP server canonical URL before requesting or forwarding bearer tokens: upgrade to ChatCLI 1.215.2, which restricts the RFC 8707 resource indicator strictly to the canonical URL of the configured MCP server, rejects metadata pointing to other resources, and confines resource metadata and SSE endpoints to the server's own origin, closing all 2 injection vectors (crafted OAuth protected resource metadata, cross-origin SSE transport endpoint redirection). Until patched, this is a concern on developer workstations where external, unverified Model Context Protocol servers are configured, so restrict connections to trusted MCP servers only; if an untrusted server was accessed, run /mcp logout and revoke the client registration at the authorization server. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated MCP OAuth resource indicator defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
