Mcp Toolbox For Databases
Monthly
Path traversal in the HTTP tool URL builder of googleapis/mcp-toolbox allows unauthenticated remote attackers to escape the operator-configured API path and reach arbitrary endpoints on the same host. By supplying crafted path parameters containing dot segments (e.g., '../'), an attacker can coerce the toolbox to forward requests—including its configured credentials—to unintended paths such as /admin/secrets. No public exploit code is known, and EPSS probability is low (0.37%), but the vulnerability is automatable with high confidentiality and integrity impact.
Missing Origin/Host header validation in Google's MCP Toolbox for Databases (Model Context Protocol server) prior to v0.25.0 allows remote attackers to reach the locally-bound HTTP server via DNS rebinding from a victim's browser, abusing the bridge to issue arbitrary tool/database commands. The fix introduces a new --allowed-hosts startup flag (companion to the existing --allowed-origins) that validates inbound Host headers, though both flags retain an insecure-by-default '*' value with only a startup warning. No public exploit identified at time of analysis; the issue was reported internally by Google.
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditionally emitting an `Access-Control-Allow-Origin: *` header, which overrides the `allowed-origins`/`allowed-hosts` controls added during beta and opens the endpoint to DNS rebinding. Any deployment using the SSE transport under MCP specification v2024-11-05 is affected, letting a remote attacker who lures a victim to a malicious web page read the victim's Toolbox/database tool responses cross-origin. Rated CVSS 4.0 9.4 with an upstream fix merged in PR #3054; no public exploit has been identified and the issue is not on CISA KEV.
Path traversal in the HTTP tool URL builder of googleapis/mcp-toolbox allows unauthenticated remote attackers to escape the operator-configured API path and reach arbitrary endpoints on the same host. By supplying crafted path parameters containing dot segments (e.g., '../'), an attacker can coerce the toolbox to forward requests—including its configured credentials—to unintended paths such as /admin/secrets. No public exploit code is known, and EPSS probability is low (0.37%), but the vulnerability is automatable with high confidentiality and integrity impact.
Missing Origin/Host header validation in Google's MCP Toolbox for Databases (Model Context Protocol server) prior to v0.25.0 allows remote attackers to reach the locally-bound HTTP server via DNS rebinding from a victim's browser, abusing the bridge to issue arbitrary tool/database commands. The fix introduces a new --allowed-hosts startup flag (companion to the existing --allowed-origins) that validates inbound Host headers, though both flags retain an insecure-by-default '*' value with only a startup warning. No public exploit identified at time of analysis; the issue was reported internally by Google.
Cross-origin data exposure in Google's MCP Toolbox for Databases stems from the SSE initialization handler unconditionally emitting an `Access-Control-Allow-Origin: *` header, which overrides the `allowed-origins`/`allowed-hosts` controls added during beta and opens the endpoint to DNS rebinding. Any deployment using the SSE transport under MCP specification v2024-11-05 is affected, letting a remote attacker who lures a victim to a malicious web page read the victim's Toolbox/database tool responses cross-origin. Rated CVSS 4.0 9.4 with an upstream fix merged in PR #3054; no public exploit has been identified and the issue is not on CISA KEV.