CVE-2026-14541

Katalog CVE

CVSS 7.5 · High EPSS 0,25%

Kerentanan Improper Authentication pada google mcp toolbox for databases. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token—even those minted for unrelated ecosystem applications—granting unauthorized clients access to protected tools and data backends.

Advisory KUTIM-CSIRT

• Peringatan Keamanan: Authentication Bypass pada Google MCP Toolbox for Databases 27 Agt 2026

Rincian

Terbit di NVD

31 Juli 2026

Terakhir diubah

8 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/googleapis/mcp-toolbox/pull/3450 issue tracking · patch