# CVE-2026-16481: Google MCP Toolbox SSRF and credential exfiltration in FHIR fetch tool

Source: https://junglewise.ai/threats/cve-2026-16481-google-mcp-toolbox-ssrf-and-credential-exfiltration-in-fhir-fetch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-16481 · Severity: info · CVSS 8.4 · Published 2026-07-27

A security vulnerability exists in a Google tool used for managing healthcare data (FHIR). An attacker can trick the tool into sending sensitive login credentials or access tokens to a server they control. This could allow unauthorized access to private patient health information and other Google Cloud services.

Technologies: [Google MCP Toolbox for Databases](https://junglewise.ai/threats/technologies/mcp-toolbox-for-databases). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-16481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16481 being exploited in the wild.

**How severe is CVE-2026-16481?** Informational severity, with a CVSS score of 8.4, published 27 July 2026.

**Which products and versions are affected?** Google MCP Toolbox for Databases 0.19.1 to 1.4.0.

**Is there a fix for CVE-2026-16481?** A patch was published on 2026-06-16: Fix submitted via pull request #3453 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16481 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16481?** Check whether you run Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the cloud-healthcare-fhir-fetch-page tool within the googleapis/mcp-toolbox. The tool fails to validate the 'pageURL' parameter, allowing it to issue HTTP GET requests to arbitrary external destinations. Because the underlying transport automatically attaches an 'Authorization: Bearer' header to all outbound requests, an attacker can exfiltrate OAuth or service-account (ADC) access tokens to a listener they control. This can lead to the exposure of Protected Health Information (PHI) and unauthorized access to secondary GCP services. The issue is addressed in pull request #3453 by introducing strict validation for the pageURL parameter.

## Affected products

- Google MCP Toolbox for Databases (mcp-toolbox) 0.19.1 to 1.4.0

## Timeline

- 2026-06-16: patched: Fix submitted via pull request #3453
- 2026-07-27: disclosed: CVE published to NVD

## References

- [https://github.com/googleapis/mcp-toolbox/pull/3453](https://github.com/googleapis/mcp-toolbox/pull/3453)

## Related threats

- [Google MCP Toolbox for Databases path traversal via symlink](https://junglewise.ai/threats/cve-2026-102242-improper-link-resolution-cwe-59-cwe-22-in-the-allowedlocalroots)
- [Google MCP Toolbox SQL injection in BigQuery forecasting tool](https://junglewise.ai/threats/cve-2026-15829-google-mcp-toolbox-sql-injection-in-bigquery-forecasting-tool)
- [Google MCP Toolbox path traversal in HTTP tool URL builder](https://junglewise.ai/threats/cve-2026-11720-google-mcp-toolbox-path-traversal-in-http-tool-url-builder)
- [Google MCP Toolbox for Databases authorization bypass in protocol handlers](https://junglewise.ai/threats/cve-2026-11719-google-mcp-toolbox-for-databases-authorization-bypass-in-protocol)
- [Google MCP Toolbox authentication bypass in validateOpaqueToken](https://junglewise.ai/threats/cve-2026-11718-google-mcp-toolbox-authentication-bypass-in-validateopaquetoken)