8.1
High
CVE-2026-14537 Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0…
Description
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mcp-toolbox | 1.4.0 | No fix stated |
| mcp-toolbox | 1.3.0 | No fix stated |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of mcp-toolbox
The 5 CVEs of mcp-toolbox →
CVE-2026-14541
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google…
8.0
High
CVE-2026-14540
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google…
8.0
High
CVE-2026-14539
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions…
6.6
Medium
CVE-2026-14538
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of…
5.7
Medium