Google Mcp-toolbox vulnerabilities

• google mcp toolbox for databases (googleapis/mcp-toolbox) Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write CVE-2026-93328 Public exploit 9.3 CriticalOctober 26, 2026
• google mcp-toolbox-sdk-python Token Cache Reuse in mcp-toolbox-sdk-python CVE-2026-19202 9.1 CriticalSeptember 22, 2026
• google mcp-toolbox, mcp toolbox for databases +1 more Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider CVE-2026-14541 8.0 HighJuly 31, 2026
• google mcp-toolbox, mcp toolbox for databases +1 more Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox CVE-2026-14540 8.0 HighJuly 31, 2026
• google mcp-toolbox, mcp toolbox for databases +1 more Denial of Service via Unrestricted Payload Buffering in MCP Toolbox CVE-2026-14539 6.6 MediumJuly 31, 2026
• google mcp-toolbox, mcp toolbox for databases +1 more BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox CVE-2026-14538 5.7 MediumJuly 31, 2026
• google mcp-toolbox, mcp toolbox for databases +1 more Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints CVE-2026-14537 8.1 HighJuly 31, 2026
• google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 more Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool CVE-2026-16481 6.0 MediumJuly 27, 2026
• google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 more SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox CVE-2026-15829 8.6 HighJuly 21, 2026
• google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 more Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder CVE-2026-11720 Fix available 9.3 CriticalJune 29, 2026
• google mcp toolbox for databases, mcp toolbox for databases (googleapis/mcp-toolbox) +1 more MCP Toolbox for Databases: authenticated authorization bypass CVE-2026-11719 Fix available 8.6 HighJune 18, 2026
• google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 more googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) CVE-2026-11718 Fix available 9.3 CriticalJune 18, 2026
• google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 more googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) CVE-2026-11717 Fix available 9.3 CriticalJune 18, 2026