Google Mcp Toolbox For Databases vulnerabilities

CVE-2026-11717 [CRITICAL] CWE-287 CVE-2026-11717: An authentication bypass vulnerability exists in the generic opaque token validation path (validateO An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes the response into an introspectResp struct where the Active field is declared as a pointer to a b

CVE-2026-15829 [HIGH] CWE-89 CVE-2026-15829: A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. The tool accepts client-controlled parameters (data_col, timestamp_col, and id_cols) as plain strings and interpolates them unescaped via fmt.Sprintf directly into a generated AI.

CVE-2026-11718 [CRITICAL] CWE-287 CVE-2026-11718: An authentication bypass vulnerability exists in the generic opaque token validation path (validateO An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into an introspectResp struct. However, the subsequent claim-checking logic (validateClaim

CVE-2026-11720 [CRITICAL] CWE-22 CVE-2026-11720: A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info,

CVE-2026-11719 [HIGH] CWE-862 CVE-2026-11719: An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missi An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this

CVE-2026-9739 [CRITICAL] CWE-942 CVE-2026-9739: Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we i Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically

CVE-2026-16481 [HIGH] CWE-918 CVE-2026-16481: A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-h A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorizati

CVE-2026-11624 [CRITICAL] CWE-346 CVE-2026-11624: The Model Context Protocol has a security warning advising servers to validate the "Origin" header o The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabl