The vulnerability stems from incorrect authorization logic in the direct HTTP API tool invocation endpoint of Google MCP Toolbox. When the --enable-api flag is active, unauthenticated users can send tool invocation requests to legacy HTTP endpoints, bypassing the scopeRequired feature that normally restricts privileged tool execution. This allows an attacker to run protected tools without credential checks, effectively enabling unauthorized control over the tool execution environment. The weakness is categorized as CWE‑863.

Affected systems are Google MCP Toolbox versions v1.3.0 and v1.4.0. No other vendors or product versions are reported as impacted.

The CVSS score of 8.1 classifies the flaw as high severity. The EPSS score of < 1% indicates a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs network access to the legacy HTTP endpoint and does not require valid credentials; the request can be crafted using standard HTTP methods. Successful exploitation allows the attacker to invoke privileged tools that are otherwise protected, presenting a significant security risk to the execution environment.