Which versions of MCP Toolbox are affected by CVE-2026-9739?

Google's MCP Toolbox for Databases contains a critical cross-origin data exposure vulnerability in its SSE transport handler that allows remote attackers to bypass origin controls and exfiltrate…. A patch is available.

How to fix or mitigate CVE-2026-9739?

Within 24 hours: Inventory all Google MCP Toolbox for Databases deployments using SSE transport (MCP spec v2024-11-05) and restrict network access to trusted sources only. Within 7 days: Monitor Google's security advisory channels and MCP project repositories for patch release following PR #3054; prepare update procedures in non-production labs. Within 30 days: Apply vendor patch upon release, or implement permanent compensating controls if patch timeline extends beyond 30 days.

MCP Toolbox CVE-2026-9739

Q: What is the CVSS score of CVE-2026-9739?

CVE-2026-9739 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-32672 CRITICAL

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-05-27 Google

GHSA-7pf3-8xx7-rvhf

Information Disclosure Cors Misconfiguration

9.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 28, 2026 - 00:51 vuln.today

Analysis Generated

May 28, 2026 - 00:51 vuln.today

CVSS changed

May 27, 2026 - 23:22 NVD

9.4 (CRITICAL)

CVE Published

May 27, 2026 - 21:38 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented allowed-origins and allowed-hosts flags to align with MCP security guidelines. However, the hardcoded Access-Control-Allow-Origin: * header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.

AnalysisAI

Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditionally emitting an Access-Control-Allow-Origin: * header, which overrides the allowed-origins/allowed-hosts controls added during beta and opens the endpoint to DNS rebinding. Any deployment using the SSE transport under MCP specification v2024-11-05 is affected, letting a remote attacker who lures a victim to a malicious web page read the victim's Toolbox/database tool responses cross-origin. Rated CVSS 4.0 9.4 with an upstream fix merged in PR #3054; no public exploit has been identified and the issue is not on CISA KEV.

Technical ContextAI

MCP Toolbox for Databases is Google's open-source server (Go, repo googleapis/mcp-toolbox) that exposes database tools to LLM agents over the Model Context Protocol. One legacy MCP transport is Server-Sent Events (SSE), defined in MCP spec revision v2024-11-05, where a client opens a long-lived HTTP stream (e.g. /mcp/sse) to receive events. The root cause is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains): the diff in internal/server/mcp.go shows the SSE handler hardcoded w.Header().Set("Access-Control-Allow-Origin", "*"), instructing browsers to permit any web origin to read the response. This wildcard CORS policy nullifies the Origin/Host allow-list that was supposed to enforce MCP's security guidance, and combined with the absence of effective Host validation it enables DNS rebinding, where an attacker re-binds a domain the browser already trusts to the loopback/internal address where Toolbox listens.

RemediationAI

Upgrade to a Toolbox release that includes the fix from PR #3054 (https://github.com/googleapis/mcp-toolbox/pull/3054), which removes the hardcoded wildcard CORS header from the SSE handler so the allowed-origins and allowed-hosts flags are actually enforced; this is an upstream fix available as a merged PR, and a tagged patched release version is not independently confirmed from the provided data, so check the repository releases for the version incorporating it (tracking issue https://github.com/googleapis/mcp-toolbox/issues/3053). Until you can upgrade, the most effective compensating control is to stop using the deprecated SSE transport and switch to the streamable-HTTP MCP transport, since the bug is specific to the SSE initialization handler (trade-off: clients pinned to spec v2024-11-05/SSE must be reconfigured). If SSE must remain, place Toolbox behind a reverse proxy or local firewall that strips/overrides the wildcard CORS header and validates the Host and Origin headers against an explicit allow-list, and bind the listener to loopback or a trusted internal interface only (trade-off: breaks any legitimately remote SSE clients); explicitly setting allowed-origins/allowed-hosts is recommended as defense-in-depth but does NOT fully mitigate on its own because the hardcoded header overrode those flags on the SSE init path in vulnerable builds.