CVE-2026-14540
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In Google mcp-toolbox versions 0.3.0 through 1.4.0, an SSRF vulnerability exists in HTTP source and tool components due to missing restrictive CheckRedirect policy and target IP validation, allowing requests to be redirected to internal or arbitrary external endpoints.
Risk Assessment
An attacker could access internal network resources or make unauthorized requests, potentially leading to data leakage or further attacks.
Recommendation
Update Google mcp-toolbox to a patched version. Configure a restrictive CheckRedirect policy and target IP validation.
Other vulnerabilities in Google mcp-toolbox
See all- CVE-2026-14537Critical
In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.
- CVE-2026-14541High
In Google mcp-toolbox version 1.4.0, when Google OAuth is configured with mcpEnabled: true without explicit audience or clientId, opaque token audience validation is skipped, allowing acceptance of any valid Google OAuth token from other applications.
- CVE-2026-14539High
Google mcp-toolbox versions up to 1.4.0 have an allocation of resources without limits vulnerability in the HTTP handler component. The /mcp endpoint reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without defensive constraints. An unauthenticated attacker can submit a single massive HTTP request, linearly consuming host memory until the process is terminated by an OOM error.
- CVE-2026-14538High
Google mcp-toolbox versions 0.16.1 through 1.4.0 have an improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. An authenticated attacker can extract structural DDL schemas for excluded datasets via INFORMATION_SCHEMA and access downstream federated row data via EXTERNAL_QUERY connections.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.