Mcp-toolbox (Google) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-07-31. Vendor: Google.

CVEs of Mcp-toolbox

• CVE-2026-14541 - CVSS 8 (high), 2026-07-31: An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google…
• CVE-2026-14540 - CVSS 8 (high), 2026-07-31: A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0.…
• CVE-2026-14539 - CVSS 7.5 (high), 2026-07-31: An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an…
• CVE-2026-14538 - CVSS 7.7 (high), 2026-07-31: An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through…
• CVE-2026-14537 - CVSS 9.8 (critical), 2026-07-31: Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to…