Read the docs
TI-2026-13765 Aliases CVE-2026-16481GHSA-qr8r-mqp7-36xx

Server-side request forgery in Google MCP Toolbox for Databases

Priority LOW 26CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleMCP Toolbox for Databases (googleapis/mcp-toolbox)0.19.1 – 1.4.0—No fix listedCNA
  • MCP Toolbox for Databases (googleapis/mcp-toolbox) VendorGoogle Affected 0.19.1 – 1.4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:mcp_toolbox_for_databases:*:*:*:*:*:*:*:*0.19.1 to before 1.5.0VulnerableGoogle
  • cpe:2.3:a:google:mcp_toolbox_for_databases:*:*:*:*:*:*:*:* Versions 0.19.1 to before 1.5.0 Vulnerable ·Google

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16481
  2. 2026-10-03 Alias added: GHSA-qr8r-mqp7-36xx

References

Patch 1

  • TI-2026-10124 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder CVSS 4.0CRITICAL 9.3
  • TI-2026-10122 Improper authentication in Google MCP Toolbox for Databases CVSS 4.0CRITICAL 9.3
  • TI-2026-10121 Improper authentication in Google MCP Toolbox for Databases CVSS 4.0CRITICAL 9.3
  • TI-2026-12267 Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints CVSS 4.0HIGH 8.1
  • TI-2026-12271 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider CVSS 4.0HIGH 8.0
  • TI-2026-12270 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox CVSS 4.0HIGH 8.0
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences