CVE-2026-11717
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An authentication bypass vulnerability exists in the googleapis/mcp-toolbox that allows bypassing authentication. The issue is related to opaque token validation, where the absence of the 'active' key in the OAuth 2.0 introspection response results in the acceptance of tokens that should not be considered valid.
Risk Assessment
The organization may be exposed to unauthorized access to protected tools and data, potentially leading to serious security breaches.
Recommendation
It is recommended to update the googleapis/mcp-toolbox to the latest version that fixes token validation and to monitor access to protected resources.
Other vulnerabilities in googleapis/mcp-toolbox
See all- CVE-2026-11720Critical
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. By supplying path parameters with directory traversal sequences (../), an attacker can bypass configured path restrictions and access unauthorized endpoints on the same target host.
- CVE-2026-11718Critical
An authentication bypass vulnerability exists in the opaque token validation path of googleapis/mcp-toolbox. This flaw allows the acceptance of tokens issued by unauthorized identity providers when the external OAuth provider's response omits the 'iss' field.
- CVE-2026-16481High
The cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox is vulnerable to SSRF and credential exfiltration. An unvalidated pageURL parameter triggers HTTP requests with an Authorization: Bearer header to arbitrary hosts, leaking OAuth tokens.
- CVE-2026-15829High
SQL injection and security boundary bypass vulnerability in the bigquery-forecast tool of googleapis/mcp-toolbox. An attacker can inject malicious SQL queries via client-controlled parameters, bypassing the allowedDatasets mechanism and accessing arbitrary BigQuery tables.
Original NVD description (English source)
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes the response into an introspectResp struct where the Active field is declared as a pointer to a boolean (*bool). The code only explicitly rejects a token if the response contains a populated active field set to false (if introspectResp.Active != nil && !*introspectResp.Active). If an introspection endpoint responds with a payload that completely omits the mandatory active key, the internal variable remains nil, causing the conditional check to short-circuit. As a result, Toolbox accepts authorization tokens missing the "active" field, granting access to protected tools and underlying data sources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS