EUVD-2026-37881
GHSA-5gf6-gc35-xjpc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote HTTP exploitation with a valid low-privilege token (PR:L), no user interaction, trivial header manipulation (AC:L); privileged tool execution yields high confidentiality and integrity impact but not availability.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
2DescriptionCVE.org
An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.
While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this check. An authenticated client with low-privilege tokens (e.g., read) can bypass the intended per-tool scope restrictions and execute high-privilege tools (e.g., admin) simply by specifying an older protocol version in the MCP-Protocol-Version header, or by omitting the header entirely (which causes the server to default to the vulnerable 2024-11-05 handler).
AnalysisAI
Authorization bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) allows authenticated low-privilege clients to invoke high-privilege tools by selecting a legacy MCP protocol version. The flaw stems from missing scopesRequired enforcement in the 2025-06-18, 2025-03-26, and 2024-11-05 protocol handlers, and is reachable simply by omitting the MCP-Protocol-Version header so the server falls back to the vulnerable 2024-11-05 default. No public exploit identified at time of analysis, but the upstream fix (PR #3335) confirms the issue and its trivial triggering condition.
Technical ContextAI
MCP Toolbox for Databases is Google's open-source server (Go, repo googleapis/mcp-toolbox) that exposes database operations as Model Context Protocol (MCP) tools to LLM clients. MCP servers negotiate a protocol version via the MCP-Protocol-Version HTTP header, and this product supports multiple historical versions in parallel. Only the newest 2025-11-25 handler invoked the per-tool scopesRequired check; the legacy 2025-06-18, 2025-03-26, and 2024-11-05 handlers dispatched tool calls without consulting the OAuth-style scope claims in the bearer token. The root cause is CWE-862 (Missing Authorization): authorization logic was implemented in one code path but not consistently across all dispatchers. The fix in PR #3335 centralizes the check into a new internal/server/mcp/util/auth.go::ValidateScopes helper that all handlers must call, comparing tool scopes against the 'scope' claim space-split from the auth token.
RemediationAI
Upgrade to the googleapis/mcp-toolbox release that incorporates PR #3335 (https://github.com/googleapis/mcp-toolbox/pull/3335), which adds the ValidateScopes helper in internal/server/mcp/util/auth.go and invokes it from every protocol handler; upstream fix available (PR/commit), released patched version not independently confirmed from the supplied data, so confirm the tagged version on the project release page before deploying. As an interim compensating control, place a reverse proxy in front of the toolbox that rewrites or rejects requests whose MCP-Protocol-Version header is missing or set to 2024-11-05, 2025-03-26, or 2025-06-18, forcing clients to the 2025-11-25 handler - be aware this will break older MCP clients that have not been updated. Where feasible, also stop issuing low-privilege tokens whose scope set is a strict subset of any admin tool's scopesRequired until the patch is applied, and audit recent tool-call logs for invocations that succeeded under tokens lacking the declared scopes.
Authentication bypass in googleapis/mcp-toolbox allows remote unauthenticated attackers to gain access by presenting opa
Authentication bypass in googleapis/mcp-toolbox lets remote unauthenticated attackers reach protected tools and backing
SQL injection and security-boundary bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) lets a low-pri
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today