Google mcp-toolbox vulnerabilities

In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.

In Google mcp-toolbox version 1.4.0, when Google OAuth is configured with mcpEnabled: true without explicit audience or clientId, opaque token audience validation is skipped, allowing acceptance of any valid Google OAuth token from other applications.

In Google mcp-toolbox versions 0.3.0 through 1.4.0, an SSRF vulnerability exists in HTTP source and tool components due to missing restrictive CheckRedirect policy and target IP validation, allowing requests to be redirected to internal or arbitrary external endpoints.

Google mcp-toolbox versions up to 1.4.0 have an allocation of resources without limits vulnerability in the HTTP handler component. The /mcp endpoint reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without defensive constraints. An unauthenticated attacker can submit a single massive HTTP request, linearly consuming host memory until the process is terminated by an OOM error.

Google mcp-toolbox versions 0.16.1 through 1.4.0 have an improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. An authenticated attacker can extract structural DDL schemas for excluded datasets via INFORMATION_SCHEMA and access downstream federated row data via EXTERNAL_QUERY connections.