Executive brief
Google's MCP Toolbox for Databases, a tool used to connect AI models to data sources, contains a security flaw that could allow malicious websites to interact with a user's database. By bypassing security restrictions, an attacker could potentially steal sensitive information from connected databases like Postgres or BigQuery or execute unauthorized commands. This occurs because the software incorrectly allows connections from any web origin, ignoring safety settings configured by administrators.
Technical details
The vulnerability stems from a hardcoded 'Access-Control-Allow-Origin: *' header in the SSE initialization handler within 'internal/server/mcp.go', which overrides global CORS middleware settings. This permissive policy, combined with the lack of host validation, makes the service susceptible to DNS rebinding attacks. An attacker can lure a user to a malicious site that uses the toolbox as a proxy to exfiltrate data or execute arbitrary tools against configured databases (e.g., Postgres, BigQuery). The issue specifically affects users utilizing SSE under specification v2024-11-05. The fix, introduced in version 1.2.0, removes the hardcoded header to allow the global CORS policy to correctly enforce 'allowed-origins' and 'allowed-hosts' flags.
Affected products
- Google MCP Toolbox for Databases < 1.2.0
Timeline
- 2026-04-14: disclosed: Issue reported on GitHub
- 2026-04-16: patched: Fix merged into main branch
- 2026-05-27: advisory: NVD publication date
- 2026-05-28: advisory: GitHub Advisory published