Mcp Toolbox
Monthly
Authentication bypass via OAuth audience confusion in Google mcp-toolbox 1.4.0 lets any holder of a valid Google OAuth access token reach protected tools and backend data. The flaw triggers when a Google authService is configured with mcpEnabled: true but no audience or clientId, causing the opaque-token path in ValidateMCPAuth to skip audience validation, so tokens minted for entirely unrelated Google ecosystem apps are accepted. Reported by Google itself; no public exploit identified at time of analysis and the CVSS 4.0 vector carries E:U (exploit unproven).
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Authorization bypass in Google mcp-toolbox v1.3.0 and v1.4.0 lets an unauthenticated remote attacker invoke tools that were meant to be protected by the scopeRequired MCP-auth feature by routing tool-invocation requests through the legacy direct HTTP API endpoints, which do not honor those scope checks. Exploitation requires the server to be started with the --enable-api flag alongside scope-protected tools. There is no public exploit identified at time of analysis (CVSS 4.0 exploit maturity is Unproven), but the flaw carries high confidentiality, integrity, and availability impact because the exposed tools can act on backend data sources.
Unbounded memory consumption in Google mcp-toolbox versions through 1.4.0 allows unauthenticated remote attackers to crash the service via a single oversized HTTP request. The /mcp endpoint's toolInvokeHandler uses Go's io.ReadAll without any body-size guard - no http.MaxBytesReader, no Content-Length pre-check - so a sufficiently large POST body linearly exhausts host RAM until the OS OOM killer terminates the process. No active exploitation is confirmed (CVSS 4.0 E:U), but the attack requires no authentication and trivial complexity, making any internet-exposed deployment an easy target for denial of service.
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.
Authentication bypass via OAuth audience confusion in Google mcp-toolbox 1.4.0 lets any holder of a valid Google OAuth access token reach protected tools and backend data. The flaw triggers when a Google authService is configured with mcpEnabled: true but no audience or clientId, causing the opaque-token path in ValidateMCPAuth to skip audience validation, so tokens minted for entirely unrelated Google ecosystem apps are accepted. Reported by Google itself; no public exploit identified at time of analysis and the CVSS 4.0 vector carries E:U (exploit unproven).
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.
Authorization bypass in Google mcp-toolbox v1.3.0 and v1.4.0 lets an unauthenticated remote attacker invoke tools that were meant to be protected by the scopeRequired MCP-auth feature by routing tool-invocation requests through the legacy direct HTTP API endpoints, which do not honor those scope checks. Exploitation requires the server to be started with the --enable-api flag alongside scope-protected tools. There is no public exploit identified at time of analysis (CVSS 4.0 exploit maturity is Unproven), but the flaw carries high confidentiality, integrity, and availability impact because the exposed tools can act on backend data sources.
Unbounded memory consumption in Google mcp-toolbox versions through 1.4.0 allows unauthenticated remote attackers to crash the service via a single oversized HTTP request. The /mcp endpoint's toolInvokeHandler uses Go's io.ReadAll without any body-size guard - no http.MaxBytesReader, no Content-Length pre-check - so a sufficiently large POST body linearly exhausts host RAM until the OS OOM killer terminates the process. No active exploitation is confirmed (CVSS 4.0 E:U), but the attack requires no authentication and trivial complexity, making any internet-exposed deployment an easy target for denial of service.
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.