# CVE-2026-14540: Google mcp-toolbox SSRF in HTTP source component

Source: https://junglewise.ai/threats/cve-2026-14540-google-mcp-toolbox-ssrf-in-http-source-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-14540 · Severity: info · CVSS 8 · Published 2026-07-31

Google's mcp-toolbox, a set of tools for Model Context Protocol (MCP) implementations, contains a security flaw in how it handles web requests. An attacker can trick the software into making unauthorized requests to internal company servers or external websites. This could lead to the exposure of sensitive internal data or allow the tool to be used as a jumping-off point for further attacks on the corporate network.

Technologies: [Google MCP Toolbox](https://junglewise.ai/threats/technologies/mcp-toolbox). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-14540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14540 being exploited in the wild.

**How severe is CVE-2026-14540?** Informational severity, with a CVSS score of 8, published 31 July 2026.

**Which products and versions are affected?** Google MCP Toolbox 0.3.0 through 1.4.0.

**Is there a fix for CVE-2026-14540?** A patch was published on 2026-06-18: Fix merged in GitHub pull request #3448 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14540 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14540?** Check whether you run Google MCP Toolbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox (specifically within internal/sources/http/http.go). The underlying HTTP client is initialized without a restrictive CheckRedirect policy and lacks target IP validation, allowing it to follow malicious redirects. An attacker can provide crafted parameters or data-driven prompts to trigger an open redirect or destination swap. This enables unauthorized requests to internal network resources or arbitrary external targets. The issue is addressed in pull request #3448 by implementing an SSRFGuard that includes DNS rebinding protection and configurable IP range restrictions.

## Affected products

- Google mcp-toolbox 0.3.0 through 1.4.0

## Timeline

- 2026-06-18: patched: Fix merged in GitHub pull request #3448
- 2026-07-31: advisory: NVD publication date

## References

- [https://github.com/googleapis/mcp-toolbox/pull/3448](https://github.com/googleapis/mcp-toolbox/pull/3448)

## Related threats

- [Google mcp-toolbox authentication bypass in Google OAuth provider](https://junglewise.ai/threats/cve-2026-14541-google-mcp-toolbox-authentication-bypass-in-google-oauth-provider)
- [Google mcp-toolbox denial of service in HTTP handler](https://junglewise.ai/threats/cve-2026-14539-google-mcp-toolbox-denial-of-service-in-http-handler)
- [Google mcp-toolbox auth bypass in bigquery-execute-sql](https://junglewise.ai/threats/cve-2026-14538-google-mcp-toolbox-auth-bypass-in-bigquery-execute-sql)
- [Google mcp-toolbox authorization bypass in legacy HTTP API](https://junglewise.ai/threats/cve-2026-14537-google-mcp-toolbox-authorization-bypass-in-legacy-http-api)
- [Google MCP Toolbox path traversal in HTTP tool URL builder](https://junglewise.ai/threats/cve-2026-11720-google-mcp-toolbox-path-traversal-in-http-tool-url-builder)