Which versions of Google mcp-toolbox are affected by CVE-2026-14541?

Google mcp-toolbox 1.4.0 contains an authentication bypass vulnerability enabling any holder of a valid Google OAuth access token to access protected tools and backend data, regardless of the token's…

How to fix or mitigate CVE-2026-14541?

Within 24 hours, identify all systems running mcp-toolbox 1.4.0 and verify whether mcpEnabled is configured to true with missing audience or clientId parameters. Within 7 days, immediately configure the Google authService with explicit audience and clientId values to enforce proper token validation, or disable mcpEnabled until a patch is available. Within 30 days, monitor Google's security advisories for patch availability and plan an upgrade to a patched version once released.

Google mcp-toolbox CVE-2026-14541

Q: What is the CVSS score of CVE-2026-14541?

CVE-2026-14541 has a CVSS 4.0 base score of 8.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51381 HIGH

Improper Authentication (CWE-287)

2026-07-31 Google

GHSA-656w-qf75-c5gf

Authentication Bypass Google Mcp Toolbox

8.0

CVSS 4.0 · Vendor: Google

Severity by source

Vendor (Google) PRIMARY

8.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable bypass needing only any valid Google token (PR:N) and low complexity; skipped audience check yields high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Google).

CVSS VectorVendor: Google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 03:13 vuln.today

Analysis Generated

Jul 31, 2026 - 03:13 vuln.today

CVE Published

Jul 31, 2026 - 01:48 cve.org

HIGH 8.0

DescriptionCVE.org

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token-even those minted for unrelated ecosystem applications-granting unauthorized clients access to protected tools and data backends.

AnalysisAI

Authentication bypass via OAuth audience confusion in Google mcp-toolbox 1.4.0 lets any holder of a valid Google OAuth access token reach protected tools and backend data. The flaw triggers when a Google authService is configured with mcpEnabled: true but no audience or clientId, causing the opaque-token path in ValidateMCPAuth to skip audience validation, so tokens minted for entirely unrelated Google ecosystem apps are accepted. Reported by Google itself; no public exploit identified at time of analysis and the CVSS 4.0 vector carries E:U (exploit unproven).

Technical ContextAI

mcp-toolbox is Google's MCP (Model Context Protocol) server/toolbox that brokers agent and client access to data backends and tools, gating them behind an authentication service. The affected component is the Google OAuth provider (internal/auth/google), which validates opaque Google OAuth access tokens. Correct OAuth/OIDC token validation must confirm the token's audience (aud) matches the resource server's own identifier (audience or clientId) so a token issued for one relying party cannot be replayed against another - the classic 'audience confusion' problem. This maps to CWE-287 (Improper Authentication): with mcpEnabled: true and neither audience nor clientId set, the ValidateMCPAuth pipeline validates the token's signature/validity but never checks who it was issued for, so authentication succeeds for any legitimately Google-signed token regardless of intended recipient.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/googleapis/mcp-toolbox/pull/3450 by upgrading to the first tagged release that includes it once published, or building from a commit that contains it. The patch makes the toolbox refuse to start (returns an error: 'audience or clientId is required when mcpEnabled is true') when mcpEnabled is true and both values are empty. As an immediate compensating control without upgrading, explicitly set the audience or clientId on every Google authService that has mcpEnabled: true so the token's aud claim is validated against your resource identifier - this closes the bypass but requires you to know and configure the correct client/audience value, and misconfiguring it can legitimately reject valid clients. Where audience/clientId cannot be set promptly, disable mcpEnabled or restrict network access to the MCP endpoint (e.g., the /mcp/sse listener) to trusted callers only, accepting that this reduces MCP functionality. Verify no unrelated Google tokens are currently being accepted by reviewing access logs for tokens whose audience does not match your application.