CVE-2026-11718
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
An authentication bypass vulnerability exists in the opaque token validation path of googleapis/mcp-toolbox. This flaw allows the acceptance of tokens issued by unauthorized identity providers when the external OAuth provider's response omits the 'iss' field.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to data breaches or other serious security incidents.
Recommendation
It is recommended to update the googleapis/mcp-toolbox library and implement additional token validation checks to ensure that only tokens from trusted providers are accepted.
Other vulnerabilities in googleapis/mcp-toolbox
See all- CVE-2026-11720Critical
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. By supplying path parameters with directory traversal sequences (../), an attacker can bypass configured path restrictions and access unauthorized endpoints on the same target host.
- CVE-2026-11717Critical
An authentication bypass vulnerability exists in the googleapis/mcp-toolbox that allows bypassing authentication. The issue is related to opaque token validation, where the absence of the 'active' key in the OAuth 2.0 introspection response results in the acceptance of tokens that should not be considered valid.
- CVE-2026-16481High
The cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox is vulnerable to SSRF and credential exfiltration. An unvalidated pageURL parameter triggers HTTP requests with an Authorization: Bearer header to arbitrary hosts, leaking OAuth tokens.
- CVE-2026-15829High
SQL injection and security boundary bypass vulnerability in the bigquery-forecast tool of googleapis/mcp-toolbox. An attacker can inject malicious SQL queries via client-controlled parameters, bypassing the allowedDatasets mechanism and accessing arbitrary BigQuery tables.
Original NVD description (English source)
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into an introspectResp struct. However, the subsequent claim-checking logic (validateClaims) evaluates the issuer condition as if a.issuer != "" && iss != "". If the external OAuth provider's introspection response omits the optional iss (issuer) field completely, the variable iss defaults to an empty string. This causes the conditional block to evaluate to false and be skipped silently. Consequently, the application accepts tokens issued by unauthorized or unintended third-party identity providers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS