CVE-2026-16481
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox is vulnerable to SSRF and credential exfiltration. An unvalidated pageURL parameter triggers HTTP requests with an Authorization: Bearer header to arbitrary hosts, leaking OAuth tokens.
Risk Assessment
An attacker can steal OAuth or service account tokens, gaining access to Protected Health Information (PHI) and other Google Cloud services.
Recommendation
Update googleapis/mcp-toolbox to a version that validates the pageURL parameter and restricts the authorization header.
Other vulnerabilities in googleapis/mcp-toolbox
See all- CVE-2026-11720Critical
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. By supplying path parameters with directory traversal sequences (../), an attacker can bypass configured path restrictions and access unauthorized endpoints on the same target host.
- CVE-2026-11718Critical
An authentication bypass vulnerability exists in the opaque token validation path of googleapis/mcp-toolbox. This flaw allows the acceptance of tokens issued by unauthorized identity providers when the external OAuth provider's response omits the 'iss' field.
- CVE-2026-11717Critical
An authentication bypass vulnerability exists in the googleapis/mcp-toolbox that allows bypassing authentication. The issue is related to opaque token validation, where the absence of the 'active' key in the OAuth 2.0 introspection response results in the acceptance of tokens that should not be considered valid.
- CVE-2026-15829High
SQL injection and security boundary bypass vulnerability in the bigquery-forecast tool of googleapis/mcp-toolbox. An attacker can inject malicious SQL queries via client-controlled parameters, bypassing the allowedDatasets mechanism and accessing arbitrary BigQuery tables.
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.