Executive brief
A security vulnerability exists in a Google tool used for managing healthcare data (FHIR). An attacker can trick the tool into sending sensitive login credentials or access tokens to a server they control. This could allow unauthorized access to private patient health information and other Google Cloud services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the cloud-healthcare-fhir-fetch-page tool within the googleapis/mcp-toolbox. The tool fails to validate the 'pageURL' parameter, allowing it to issue HTTP GET requests to arbitrary external destinations. Because the underlying transport automatically attaches an 'Authorization: Bearer' header to all outbound requests, an attacker can exfiltrate OAuth or service-account (ADC) access tokens to a listener they control. This can lead to the exposure of Protected Health Information (PHI) and unauthorized access to secondary GCP services. The issue is addressed in pull request #3453 by introducing strict validation for the pageURL parameter.
Affected products
- Google MCP Toolbox for Databases (mcp-toolbox) 0.19.1 to 1.4.0
Timeline
- 2026-06-16: patched: Fix submitted via pull request #3453
- 2026-07-27: disclosed: CVE published to NVD