CVE-2026-9739: Google MCP Toolbox CORS bypass in SSE handler

CVE-2026-9739 · Severity: critical · CVSS 4 · Published 2026-05-27

Google's MCP Toolbox for Databases, a tool used to connect AI models to data sources, contains a security flaw that could allow malicious websites to interact with a user's database. By bypassing security restrictions, an attacker could potentially steal sensitive information from connected databases like Postgres or BigQuery or execute unauthorized commands. This occurs because the software incorrectly allows connections from any web origin, ignoring safety settings configured by administrators.

Technologies: github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox, Google MCP Toolbox for Databases. Vendors: Go, Google.

Quick answers

Is CVE-2026-9739 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9739 being exploited in the wild.
How severe is CVE-2026-9739?
Critical severity, with a CVSS score of 4, published 27 May 2026.
Which products and versions are affected?
github.com/googleapis/mcp-toolbox (Go) < 1.2.0, SEMVER:introduced=0,fixed=1.2.0; Google MCP Toolbox v2024-11-05 specification users; Google MCP Toolbox for Databases < 1.2.0.
Is there a fix for CVE-2026-9739?
Yes. github.com/googleapis/mcp-toolbox (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9739 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9739?
Check whether you run github.com/googleapis/mcp-toolbox (Go), Google MCP Toolbox or Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/googleapis/mcp-toolbox (Go): upgrade to 1.2.0 or later
    go get github.com/googleapis/mcp-toolbox@v1.2.0

Technical details

The vulnerability stems from a hardcoded 'Access-Control-Allow-Origin: *' header in the SSE initialization handler within 'internal/server/mcp.go', which overrides global CORS middleware settings. This permissive policy, combined with the lack of host validation, makes the service susceptible to DNS rebinding attacks. An attacker can lure a user to a malicious site that uses the toolbox as a proxy to exfiltrate data or execute arbitrary tools against configured databases (e.g., Postgres, BigQuery). The issue specifically affects users utilizing SSE under specification v2024-11-05. The fix, introduced in version 1.2.0, removes the hardcoded header to allow the global CORS policy to correctly enforce 'allowed-origins' and 'allowed-hosts' flags.

Affected products

  • Google MCP Toolbox for Databases < 1.2.0

Identifiers

  • CVE-2026-9739
  • GHSA-7pf3-8xx7-rvhf
  • GO-2026-5870

Timeline

  • 2026-04-14: disclosed: Issue reported on GitHub
  • 2026-04-16: patched: Fix merged into main branch
  • 2026-05-27: advisory: NVD publication date
  • 2026-05-28: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.