Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

11 records

Vendor: Google Component: Mcp Toolbox For Databases Clear all filters
TI-2026-12269 CVE-2026-14539 · GHSA-623p-8r6m-hwc6

Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

Priority LOW 35

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS).

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00238 Published 2026-07-31 No fix listed CWE-770
TI-2026-12268 CVE-2026-14538 · GHSA-24pp-m59v-92j8

BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox

Priority LOW 25

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatase…

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00204 Published 2026-07-31 No fix listed CWE-285
TI-2026-12267 CVE-2026-14537 · GHSA-f8h2-c55w-8m5p

Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints

Priority MEDIUM 43

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sendi…

CVSS 4.0HIGH 8.1 Network No auth No interaction EPSS 0.00252 Published 2026-07-31 No fix listed CWE-863
TI-2026-13765 CVE-2026-16481 · GHSA-qr8r-mqp7-36xx

Server-side request forgery in Google MCP Toolbox for Databases

Priority LOW 26

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00193 Published 2026-07-27 No fix listed CWE-918
TI-2026-13310 CVE-2026-15829 · GHSA-wvx3-gvxv-cmxc

SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

Priority LOW 39

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00197 Published 2026-07-21 No fix listed CWE-863
TI-2026-10123 CVE-2026-11719 · GHSA-5gf6-gc35-xjpc

Missing authorization in Google MCP Toolbox for Databases

Priority LOW 38

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00145 Published 2026-06-18 Fixed in 1.4.0 CWE-862
TI-2026-10122 CVE-2026-11718 · GHSA-wcpr-6g7x-p44r

Improper authentication in Google MCP Toolbox for Databases

Priority MEDIUM 47

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00185 Published 2026-06-18 Fixed in 1.4.0 CWE-287
TI-2026-10121 CVE-2026-11717 · GHSA-8fcc-w5hv-4gxv

Improper authentication in Google MCP Toolbox for Databases

Priority MEDIUM 47

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00176 Published 2026-06-18 Fixed in 1.4.0 CWE-287