CVE-2026-14537

CriticalCVSS 9.8

Published: 31/07/2026(UTC)Updated: 08/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.

Risk Assessment

An unauthenticated attacker could access protected tools, potentially compromising data and system security.

Recommendation

Update Google mcp-toolbox to a patched version. Disable legacy HTTP endpoints or restrict their availability.

Original NVD description (English source)

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.