MCP Toolbox CVE-2026-9739

Exploitation requires the target to be running MCP Toolbox for Databases with the SSE transport enabled under MCP specification v2024-11-05 - deployments using other transports (e.g. streamable HTTP) are not affected by this SSE-init-handler bug. The attacker does not need credentials (PR:N), but does need the victim to actively load attacker-controlled content in a browser (UI:A) and the victim's browser must be able to reach the Toolbox listener (typically localhost or an internal network address), which is what DNS rebinding abuses. The hardcoded Access-Control-Allow-Origin: * is the enabling condition: it overrode the allowed-origins/allowed-hosts allow-list, so even Toolbox instances configured with those flags remained exposed on the SSE path. Limiting factors that reduce realistic risk: the required user interaction, the browser-based cross-origin attack model, dependence on the listener being reachable from the victim's browser, and the scope being confined to the SSE transport rather than all endpoints.

Signals are mixed. The CVSS 4.0 base of 9.4 reflects AV:N, AC:L, AT:N, PR:N (unauthenticated) and high confidentiality/integrity/availability impact on both the vulnerable and subsequent systems, which is severe on paper. However, the same vector contains UI:A (active user interaction required), meaning exploitation depends on the victim being induced to load attacker-controlled content in a browser - a real but non-trivial precondition that lowers practical likelihood versus a purely server-to-server flaw. The tags (Information Disclosure, CORS Misconfiguration) and CWE-942 point to data theft as the primary realistic outcome via browser-mediated cross-origin reads, even though the scored impact metrics are uniformly High. No EPSS score, KEV listing, or POC was provided in the input, so this should be treated as no public exploit identified at time of analysis rather than active exploitation. Net: a genuinely high-severity misconfiguration that warrants prompt patching for anyone running the SSE transport, but the user-interaction requirement and browser-based attack model make mass, unattended exploitation less likely than the 9.4 alone suggests - verify your transport mode before deprioritizing.

An attacker hosts a malicious web page and entices a developer who is running Toolbox locally with the SSE transport to visit it. Using DNS rebinding, the page's JavaScript directs the victim's browser to the loopback/internal address where Toolbox listens; because the SSE handler returns Access-Control-Allow-Origin: *, the browser permits the malicious origin to read the SSE stream and exfiltrate database tool output. No authentication is required (PR:N), but the attack hinges on the victim loading the attacker's page (UI:A); no public proof-of-concept was provided in the input.