Executive brief
Google's mcp-toolbox, a set of tools for Model Context Protocol (MCP) implementations, contains a security flaw in how it handles web requests. An attacker can trick the software into making unauthorized requests to internal company servers or external websites. This could lead to the exposure of sensitive internal data or allow the tool to be used as a jumping-off point for further attacks on the corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox (specifically within internal/sources/http/http.go). The underlying HTTP client is initialized without a restrictive CheckRedirect policy and lacks target IP validation, allowing it to follow malicious redirects. An attacker can provide crafted parameters or data-driven prompts to trigger an open redirect or destination swap. This enables unauthorized requests to internal network resources or arbitrary external targets. The issue is addressed in pull request #3448 by implementing an SSRFGuard that includes DNS rebinding protection and configurable IP range restrictions.
Affected products
- Google mcp-toolbox 0.3.0 through 1.4.0
Timeline
- 2026-06-18: patched: Fix merged in GitHub pull request #3448
- 2026-07-31: advisory: NVD publication date