# CVE-2026-11717: Google MCP Toolbox authentication bypass in validateOpaqueToken

Source: https://junglewise.ai/threats/cve-2026-11717-google-mcp-toolbox-authentication-bypass-in-validateopaquetoken  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-11717 · Severity: critical · CVSS 4 · Published 2026-06-18

Google's MCP Toolbox, a tool used for connecting databases to AI models, contains a security flaw in how it verifies user identity. An attacker can bypass authentication by providing a specially crafted security token that omits a required status field, tricking the system into granting unauthorized access. This could allow an attacker to access protected tools and sensitive underlying data sources without valid credentials.

Technologies: [github.com/googleapis/mcp-toolbox (Go)](https://junglewise.ai/threats/technologies/github-com-googleapis-mcp-toolbox), [Google MCP Toolbox for Databases](https://junglewise.ai/threats/technologies/mcp-toolbox-for-databases). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-11717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11717 being exploited in the wild.

**How severe is CVE-2026-11717?** Critical severity, with a CVSS score of 4, published 18 June 2026.

**Which products and versions are affected?** github.com/googleapis/mcp-toolbox (Go) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0; Google MCP Toolbox for Databases < 1.4.0, 1.0.0 to 1.3.0.

**Is there a fix for CVE-2026-11717?** Yes. github.com/googleapis/mcp-toolbox (Go): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11717 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11717?** Check whether you run github.com/googleapis/mcp-toolbox (Go) or Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/googleapis/mcp-toolbox (Go): upgrade to 1.4.0 or later

  ```sh
  go get github.com/googleapis/mcp-toolbox@v1.4.0
  ```


## Technical details

An authentication bypass exists in the `validateOpaqueToken` function of the MCP Toolbox. When performing OAuth 2.0 introspection (RFC 7662), the toolbox decodes the response into a struct where the `Active` field is a boolean pointer (`*bool`). The validation logic only rejects tokens if the field is explicitly present and set to `false`. If an introspection endpoint returns a payload that entirely omits the mandatory `active` key, the pointer remains `nil`, causing the validation check to short-circuit and incorrectly treat the token as valid. This allows remote, unauthenticated attackers to bypass security controls and access protected resources. The issue is addressed in pull request #3341.

## Affected products

- Google MCP Toolbox for Databases (mcp-toolbox) 1.0.0 to 1.3.0

## Identifiers

- CVE-2026-11717
- GHSA-8fcc-w5hv-4gxv
- GO-2026-5251

## Timeline

- 2026-06-03: patched: Fix submitted via Pull Request 3341
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/googleapis/mcp-toolbox/pull/3341](https://github.com/googleapis/mcp-toolbox/pull/3341)

## Related threats

- [Google MCP Toolbox for Databases path traversal via symlink](https://junglewise.ai/threats/cve-2026-102242-improper-link-resolution-cwe-59-cwe-22-in-the-allowedlocalroots)
- [Google MCP Toolbox SSRF and credential exfiltration in FHIR fetch tool](https://junglewise.ai/threats/cve-2026-16481-google-mcp-toolbox-ssrf-and-credential-exfiltration-in-fhir-fetch)
- [Google MCP Toolbox SQL injection in BigQuery forecasting tool](https://junglewise.ai/threats/cve-2026-15829-google-mcp-toolbox-sql-injection-in-bigquery-forecasting-tool)
- [Google MCP Toolbox path traversal in HTTP tool URL builder](https://junglewise.ai/threats/cve-2026-11720-google-mcp-toolbox-path-traversal-in-http-tool-url-builder)
- [Google MCP Toolbox for Databases authorization bypass in protocol handlers](https://junglewise.ai/threats/cve-2026-11719-google-mcp-toolbox-for-databases-authorization-bypass-in-protocol)