A path traversal flaw exists in the HTTP tool URL builder of Google’s MCP Toolbox for Databases. The builder concatenates user‑controlled pathParams into a configured path and then parses the result as a relative URL. Though it checks the scheme, host, and user info, it relies on ResolveReference for resolution; dot segments (../) are normalized during this step. An attacker may thus supply traversal sequences in pathParams, causing the toolbox to resolve outside the intended tool path and forward the operator’s credentials to unintended endpoints on the same host. This can expose sensitive data or allow the attacker to invoke restricted API calls such as /admin/secrets, effectively elevating privileges or obtaining confidential information.

The vulnerability affects Google’s MCP Toolbox for Databases (googleapis/mcp-toolbox). No specific version ranges are listed, so all versions that include the vulnerable URL builder logic are potentially impacted.

The CVSS score of 9.3 indicates a high severity with full exploitation potential. The EPSS score is not available but the lack of an KEV listing does not diminish the risk; the flaw is locally exploitable by inserting crafted path parameters into any request that uses the toolbox’s URL builder. An attacker who can influence the pathParams—such as a compromised operator or a malicious service using the toolbox—can make the toolbox send requests to any endpoint on the configured host, using the toolbox’s configured credentials. The result is unauthorized access or data leakage. Given the simply normalizing bug and lack of input validation, exploitation is straightforward once the attacker can influence the pathParams.