CVE-2026-11624: Google MCP Toolbox DNS rebinding via insufficient header validation

CVE-2026-11624 · Severity: critical · CVSS 4 · Published 2026-06-13

The MCP Toolbox for Databases is a server that provides database access to AI agents via the Model Context Protocol. Prior to version 0.25.0, it failed to validate the Origin and Host headers on incoming requests, allowing attackers to exploit DNS rebinding attacks. An attacker could trick a user into visiting a malicious website, which would then gain full remote control over the user's locally running MCP Toolbox server, enabling database manipulation, data theft, and unauthorized resource creation.

Technologies: github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox for Databases. Vendors: Go, Google.

Quick answers

Is CVE-2026-11624 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11624 being exploited in the wild.
How severe is CVE-2026-11624?
Critical severity, with a CVSS score of 4, published 13 June 2026.
Which products and versions are affected?
github.com/googleapis/genai-toolbox (Go) SEMVER:introduced=0,fixed=0.25.0; github.com/googleapis/mcp-toolbox (Go) < 0.25.0, SEMVER:introduced=0,fixed=0.25.0; Google MCP Toolbox for Databases < 0.25.0; Google Model Context Protocol Toolbox < v0.25.0.
Is there a fix for CVE-2026-11624?
Yes. github.com/googleapis/genai-toolbox (Go): upgrade to 0.25.0 or later; github.com/googleapis/mcp-toolbox (Go): upgrade to 0.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11624 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11624?
Check whether you run github.com/googleapis/genai-toolbox (Go), github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox for Databases or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/googleapis/genai-toolbox (Go): upgrade to 0.25.0 or later
    go get github.com/googleapis/genai-toolbox@v0.25.0
  • github.com/googleapis/mcp-toolbox (Go): upgrade to 0.25.0 or later
    go get github.com/googleapis/mcp-toolbox@v0.25.0

Technical details

This vulnerability is a DNS rebinding attack arising from insufficient Origin and Host header validation (CWE-346). The MCP Toolbox HTTP server, by default in versions prior to 0.25.0, accepted requests from any origin and did not validate the Host header. This allowed an attacker to craft a malicious website that, via DNS rebinding, initially resolves to an attacker-controlled server to load JavaScript, then rebinds to localhost to issue cross-origin requests to the victim's local MCP Toolbox instance. Since the Origin header was not validated, the server accepted these requests. The attack requires user interaction (visiting a malicious site) but then grants the attacker network-level access to the locally running service. Version 0.25.0 remediated this by introducing --allowed-hosts and --allowed-origins configuration flags; however, both default to "*" to avoid breaking existing deployments, and servers output a startup warning if either remains permissive.

Affected products

  • Google MCP Toolbox for Databases < 0.25.0

Identifiers

  • CVE-2026-11624
  • GHSA-76g7-m3xw-x9gr
  • GO-2026-6288

Timeline

  • 2026-06-13: disclosed: Published to GitHub Advisory Database
  • 2026-01-08: patched: Fix released in v0.25.0 with --allowed-hosts and --allowed-origins flags

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.