Executive brief
Google mcp-toolbox is a developer tool used for managing Model Context Protocol (MCP) integrations. A security flaw in versions 1.3.0 and 1.4.0 allows unauthorized users to bypass security restrictions and execute internal tools. This could lead to unauthorized data access or the execution of sensitive operations within the environment where the toolbox is deployed.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Google mcp-toolbox v1.3.0 and v1.4.0 within the direct HTTP API tool invocation endpoint. When the '--enable-api' flag is active, the application fails to properly enforce 'scopeRequired' authorization policies on legacy HTTP endpoints. An unauthenticated remote attacker can exploit this by sending tool invocation requests through these legacy endpoints, effectively bypassing intended access controls. The issue has been addressed in subsequent updates by introducing a startup validation check that prevents the server from running if both MCP Authorization and the legacy HTTP API are enabled simultaneously.
Affected products
- Google mcp-toolbox v1.3.0, v1.4.0
Timeline
- 2026-06-15: disclosed: Issue reported and PR created
- 2026-06-18: patched: Fix merged into main branch
- 2026-07-31: advisory: CVE published to NVD