EUVD-2026-51374
GHSA-3x3x-8ffg-ghcv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF needing no auth or interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality and integrity from internal reads/writes, no availability impact, scope unchanged.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
3DescriptionCVE.org
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.
AnalysisAI
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Technical ContextAI
The affected component is the generic HTTP source and tool in Google's mcp-toolbox (an MCP server that brokers tool/data-source calls for AI agents), specifically cpe:2.3:a:google:mcp-toolbox. The root cause is CWE-918 (SSRF): the Go net/http client was built as a bare http.Transport{} with a default redirect policy and no destination validation, so an attacker-influenced path parameter can cause the server to follow a 3xx redirect (open redirect) or resolve to an attacker-chosen host. This is compounded by DNS-rebinding (TOCTOU) exposure, since without resolving and re-checking the connection target the client can be pointed at loopback (127.0.0.1), RFC 1918 private ranges, or cloud metadata services (e.g., 169.254.169.254 for AWS/GCP). The PR #3448 fix introduces an SSRFGuard that resolves and blocks private/link-local/loopback ranges by default, plus allowPrivateNetworks, allowedIpRanges, and customBlockedIpRanges configuration knobs.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/googleapis/mcp-toolbox/pull/3448, which add a default SSRFGuard that resolves and blocks loopback, RFC 1918, and link-local ranges (including the 169.254.169.254 metadata endpoint) and introduces allowPrivateNetworks, allowedIpRanges, and customBlockedIpRanges controls; upgrade to the first released build that contains this PR once identified. Until you can deploy the fixed build, restrict the HTTP source configuration so baseUrl points only to trusted external hosts, place the mcp-toolbox process on a network segment with egress filtering that denies traffic to internal RFC 1918 ranges and the cloud metadata IP 169.254.169.254 (trade-off: may break legitimate internal integrations that must be explicitly allowlisted), and treat any data or prompt that can influence HTTP path parameters as untrusted. Avoid enabling InsecureSkipVerify in production, as the patch notes it exposes traffic to MITM.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today