# CVE-2026-11718: Google MCP Toolbox authentication bypass in validateOpaqueToken

Source: https://junglewise.ai/threats/cve-2026-11718-google-mcp-toolbox-authentication-bypass-in-validateopaquetoken  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-11718 · Severity: critical · CVSS 4 · Published 2026-06-18

A security flaw in the Google MCP Toolbox for Databases allows unauthorized users to bypass authentication. The software fails to properly verify the identity of the service issuing security tokens if that information is missing from the login response. This could allow an attacker to use tokens from unauthorized sources to gain access to protected database tools and data.

Technologies: [github.com/googleapis/mcp-toolbox (Go)](https://junglewise.ai/threats/technologies/github-com-googleapis-mcp-toolbox), [Google MCP Toolbox](https://junglewise.ai/threats/technologies/mcp-toolbox), [Google MCP Toolbox for Databases](https://junglewise.ai/threats/technologies/mcp-toolbox-for-databases). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-11718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11718 being exploited in the wild.

**How severe is CVE-2026-11718?** Critical severity, with a CVSS score of 4, published 18 June 2026.

**Which products and versions are affected?** github.com/googleapis/mcp-toolbox (Go) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0; Google MCP Toolbox < 1.4.0; Google MCP Toolbox for Databases 1.0.0 to 1.3.0.

**Is there a fix for CVE-2026-11718?** Yes. github.com/googleapis/mcp-toolbox (Go): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11718 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11718?** Check whether you run github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox or Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/googleapis/mcp-toolbox (Go): upgrade to 1.4.0 or later

  ```sh
  go get github.com/googleapis/mcp-toolbox@v1.4.0
  ```


## Technical details

An authentication bypass vulnerability exists in the `validateOpaqueToken` function of the Google MCP Toolbox. When validating opaque tokens via OAuth 2.0 introspection (RFC 7662), the `validateClaims` logic incorrectly handles cases where the `iss` (issuer) field is missing from the introspection response. Because the code evaluates the issuer condition only if both the expected issuer and the response issuer are non-empty strings, a missing `iss` field (defaulting to an empty string) causes the validation check to be skipped entirely. This allows the application to accept tokens from unauthorized or unintended third-party identity providers. The issue is addressed in pull request #3360 by enforcing issuer presence.

## Affected products

- Google MCP Toolbox for Databases (mcp-toolbox) 1.0.0 to 1.3.0

## Identifiers

- CVE-2026-11718
- GHSA-wcpr-6g7x-p44r
- GO-2026-5706

## Timeline

- 2026-06-04: patched: Fix merged in pull request #3360
- 2026-06-18: disclosed: CVE published to NVD

## References

- [https://github.com/googleapis/mcp-toolbox/pull/3360](https://github.com/googleapis/mcp-toolbox/pull/3360)

## Related threats

- [Google MCP Toolbox for Databases path traversal via symlink](https://junglewise.ai/threats/cve-2026-102242-improper-link-resolution-cwe-59-cwe-22-in-the-allowedlocalroots)
- [Google mcp-toolbox authentication bypass in Google OAuth provider](https://junglewise.ai/threats/cve-2026-14541-google-mcp-toolbox-authentication-bypass-in-google-oauth-provider)
- [Google mcp-toolbox SSRF in HTTP source component](https://junglewise.ai/threats/cve-2026-14540-google-mcp-toolbox-ssrf-in-http-source-component)
- [Google mcp-toolbox denial of service in HTTP handler](https://junglewise.ai/threats/cve-2026-14539-google-mcp-toolbox-denial-of-service-in-http-handler)
- [Google mcp-toolbox auth bypass in bigquery-execute-sql](https://junglewise.ai/threats/cve-2026-14538-google-mcp-toolbox-auth-bypass-in-bigquery-execute-sql)