CVE-2026-11717: Google MCP Toolbox authentication bypass in validateOpaqueToken

CVE-2026-11717 · Severity: critical · CVSS 4 · Published 2026-06-18

Google's MCP Toolbox, a tool used for connecting databases to AI models, contains a security flaw in how it verifies user identity. An attacker can bypass authentication by providing a specially crafted security token that omits a required status field, tricking the system into granting unauthorized access. This could allow an attacker to access protected tools and sensitive underlying data sources without valid credentials.

Technologies: github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox for Databases. Vendors: Go, Google.

Quick answers

Is CVE-2026-11717 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11717 being exploited in the wild.
How severe is CVE-2026-11717?
Critical severity, with a CVSS score of 4, published 18 June 2026.
Which products and versions are affected?
github.com/googleapis/mcp-toolbox (Go) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0; Google MCP Toolbox for Databases < 1.4.0, 1.0.0 to 1.3.0.
Is there a fix for CVE-2026-11717?
Yes. github.com/googleapis/mcp-toolbox (Go): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11717 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-11717?
Check whether you run github.com/googleapis/mcp-toolbox (Go) or Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/googleapis/mcp-toolbox (Go): upgrade to 1.4.0 or later
    go get github.com/googleapis/mcp-toolbox@v1.4.0

Technical details

An authentication bypass exists in the `validateOpaqueToken` function of the MCP Toolbox. When performing OAuth 2.0 introspection (RFC 7662), the toolbox decodes the response into a struct where the `Active` field is a boolean pointer (`*bool`). The validation logic only rejects tokens if the field is explicitly present and set to `false`. If an introspection endpoint returns a payload that entirely omits the mandatory `active` key, the pointer remains `nil`, causing the validation check to short-circuit and incorrectly treat the token as valid. This allows remote, unauthenticated attackers to bypass security controls and access protected resources. The issue is addressed in pull request #3341.

Affected products

  • Google MCP Toolbox for Databases (mcp-toolbox) 1.0.0 to 1.3.0

Identifiers

  • CVE-2026-11717
  • GHSA-8fcc-w5hv-4gxv
  • GO-2026-5251

Timeline

  • 2026-06-03: patched: Fix submitted via Pull Request 3341
  • 2026-06-18: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.