Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-11720: Google MCP Toolbox HTTP Tool Can Make Unauthorized API Requests
CVE-2026-11720
Summary
The Google MCP Toolbox HTTP tool can make unauthorized API requests to unintended endpoints on the same target host. This is because an attacker can manipulate the URL to escape the intended path, potentially accessing sensitive data. To mitigate this risk, ensure that the toolbox is configured to only access authorized endpoints and consider implementing additional security measures to restrict access to sensitive data.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mcp_toolbox_for_databases |
< 1.3.0 cpe:2.3:a:google:mcp_toolbox_for_databases:*:*:*:*:*:*:*:* |
Original title
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox.
When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into...
Original description
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox.
When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).
When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).
nvd CVSS4.0
9.3
Vulnerability type
CWE-22
Path Traversal
Published: 29 Jun 2026 · Updated: 23 Jul 2026 · First seen: 29 Jun 2026