Advisories · Technology
Google mcp-toolbox.
Every CVE that names Google mcp-toolbox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.0 High
Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
- Google mcp-toolbox
- Authentication bypass
- CVSS 8.0 High
Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
- Google mcp-toolbox
- Server-side request forgery (SSRF)
- CVSS 6.6 Medium
Denial of Service via Unrestricted Payload Buffering in MCP Toolbox
- Google mcp-toolbox
- Denial of service
- CVSS 5.7 Medium
BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
- Google mcp-toolbox
- Broken access control
- CVSS 8.1 High
Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
- Google mcp-toolbox
- Broken access control