Executive brief
A security flaw in the Google MCP Toolbox for Databases allows unauthorized users to bypass authentication. The software fails to properly verify the identity of the service issuing security tokens if that information is missing from the login response. This could allow an attacker to use tokens from unauthorized sources to gain access to protected database tools and data.
Technical details
An authentication bypass vulnerability exists in the `validateOpaqueToken` function of the Google MCP Toolbox. When validating opaque tokens via OAuth 2.0 introspection (RFC 7662), the `validateClaims` logic incorrectly handles cases where the `iss` (issuer) field is missing from the introspection response. Because the code evaluates the issuer condition only if both the expected issuer and the response issuer are non-empty strings, a missing `iss` field (defaulting to an empty string) causes the validation check to be skipped entirely. This allows the application to accept tokens from unauthorized or unintended third-party identity providers. The issue is addressed in pull request #3360 by enforcing issuer presence.
Affected products
- Google MCP Toolbox for Databases (mcp-toolbox) 1.0.0 to 1.3.0
Timeline
- 2026-06-04: patched: Fix merged in pull request #3360
- 2026-06-18: disclosed: CVE published to NVD