Google Mcp-toolbox
5 CVEs affecting Google Mcp-toolbox. Latest disclosed: 2026-07-31. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14541 | | 2026-07-31 | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google… | |
CVE-2026-14540 | | 2026-07-31 | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. Wh… | |
CVE-2026-14539 | | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauth… | |
CVE-2026-14538 | | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1… | |
CVE-2026-14537 | | 2026-07-31 | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to… |