Is there a patch available for CVE-2026-11720?

Yes, a patch is available for CVE-2026-11720. Update the affected software to the latest version immediately.

Mcp Toolbox For Databases CVE-2026-11720

Q: What is the CVSS score of CVE-2026-11720?

CVE-2026-11720 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40146 CRITICAL

Path Traversal (CWE-22)

2026-06-29 cve-coordination@google.com

GHSA-vwxw-jrg6-9jxv

Path Traversal Google Mcp Toolbox For Databases

9.3

CVSS 4.0 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Tool caller controls pathParams with no extra privileges or interaction (PR:N/UI:N/AC:L/AV:N); traversal exposes and lets the credentialed client act on restricted endpoints (C:H/I:H), no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 10:07 vuln.today

Patch available

Jun 29, 2026 - 19:01 EUVD

Analysis Generated

Jun 29, 2026 - 18:30 vuln.today

CVE Published

Jun 29, 2026 - 18:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox.

When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).

AnalysisAI

Path traversal in the HTTP tool URL builder of googleapis/mcp-toolbox allows unauthenticated remote attackers to escape the operator-configured API path and reach arbitrary endpoints on the same host. By supplying crafted path parameters containing dot segments (e.g., '../'), an attacker can coerce the toolbox to forward requests—including its configured credentials—to unintended paths such as /admin/secrets. No public exploit code is known, and EPSS probability is low (0.37%), but the vulnerability is automatable with high confidentiality and integrity impact.