EUVD-2026-37879
GHSA-8fcc-w5hv-4gxv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable MCP endpoint, no auth or user interaction, trivial logic bypass yields full read/write to protected tools and backing databases; availability not directly impacted.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.
When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes the response into an introspectResp struct where the Active field is declared as a pointer to a boolean (*bool). The code only explicitly rejects a token if the response contains a populated active field set to false (if introspectResp.Active != nil && !*introspectResp.Active). If an introspection endpoint responds with a payload that completely omits the mandatory active key, the internal variable remains nil, causing the conditional check to short-circuit. As a result, Toolbox accepts authorization tokens missing the "active" field, granting access to protected tools and underlying data sources.
AnalysisAI
Authentication bypass in googleapis/mcp-toolbox lets remote unauthenticated attackers reach protected tools and backing data sources by submitting an OAuth 2.0 introspection response that omits the mandatory 'active' field. Because validateOpaqueToken stores Active as *bool and only rejects when the pointer is non-nil and false, a nil value falls through as authorized. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.3 and trivial logic flaw make this a priority fix.
Technical ContextAI
MCP Toolbox is Google's open-source server (googleapis/mcp-toolbox) that exposes database tools to Model Context Protocol clients and supports OAuth 2.0 protected resources. The flaw lives in the generic opaque-token authentication mode, which validates bearer tokens by calling an RFC 7662 introspection endpoint. The introspectResp Go struct declares Active as *bool so the parser can distinguish 'omitted' from 'false', but the validation logic conflates the two: if introspectResp.Active != nil && !*introspectResp.Active only rejects when active is explicitly false. RFC 7662 mandates that the 'active' member be present, so a non-compliant or attacker-controlled introspection response that drops the field bypasses the check entirely. CWE-287 (Improper Authentication) captures the root cause - a missing default-deny on a security-critical boolean. The PR (#3341) additionally documents that Google's tokeninfo endpoint does not return an active claim and must not be configured as a type: generic auth service.
RemediationAI
Upstream fix available (PR https://github.com/googleapis/mcp-toolbox/pull/3341); released patched version not independently confirmed from the supplied data, so upgrade to the first tagged release that incorporates this PR once published and rebuild/redeploy the toolbox binary. As an immediate workaround, remove or disable any type: generic authService that points at an introspection endpoint which may omit the active field - in particular, do not point the generic provider at Google's https://oauth2.googleapis.com/tokeninfo; the PR explicitly redirects Google deployments to the native type: google Sign-In provider, which validates ID and opaque tokens correctly (side effect: existing clients must switch token formats/headers to Authorization: Bearer). If you cannot change provider, restrict the introspection endpoint to a fully RFC 7662-compliant IdP under your control, place the toolbox behind an authenticating reverse proxy or VPN, and audit access logs for tool invocations whose introspection responses lacked an active claim until patched.
Authentication bypass in googleapis/mcp-toolbox allows remote unauthenticated attackers to gain access by presenting opa
SQL injection and security-boundary bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) lets a low-pri
Authorization bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) allows authenticated low-privilege c
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today