Description
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.
Published: 2026-07-31
Score: 8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A Server‑Side Request Forgery flaw exists in the generic HTTP source and tool components of Google mcp‑toolbox versions 0.3.0 through 1.4.0. The HTTP client is created without a restrictive CheckRedirect policy and lacks target IP validation. An attacker can supply a crafted path parameter that forces the toolbox to follow an open redirect or a direct destination change on the target backend, causing the tool to automatically request internal or arbitrary external endpoints. This enables the attacker to read data from internal services, exfiltrate sensitive information, or interact with systems that are not intended to be reachable by the toolbox.

Affected Systems

Google mcp‑toolbox, versions 0.3.0 to 1.4.0, inclusive. All releases within this range are affected.

Risk and Exploitability

The CVSS score of 8.0 indicates a high severity vulnerability with a broad impact. The EPSS score of <1% shows that the probability of exploitation is very low but not zero. The vulnerability is not listed in CISA KEV. The likely attack vector is remote, via crafted input parameters sent to the mcp‑toolbox. If an attacker can influence any of the generic HTTP source parameters, they can trigger the unsafe redirect and cause the tool to make unauthorized outbound requests to internal or arbitrary external networks.

Generated by OpenCVE AI on August 2, 2026 at 04:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade mcp‑toolbox to the latest stable release that contains a fix for the redirect handling flaw.
  • Configure the internal HTTP client to enforce a strict redirect policy or to reject redirects that lead to hosts outside the intended domain, and validate target IP addresses before following.
  • Apply network segmentation or firewall rules to isolate the mcp‑toolbox and block outbound requests to sensitive internal systems, thereby limiting the impact of any potential SSRF.

Generated by OpenCVE AI on August 2, 2026 at 04:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google mcp-toolbox
Vendors & Products Google
Google mcp-toolbox

Fri, 31 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 31 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Description A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.
Title Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U'}

Subscriptions

Google Mcp-toolbox Mcp Toolbox For Databases
cve-icon MITRE

Status: PUBLISHED

Assigner: Google

Published:

Updated: 2026-07-31T16:12:49.663Z

Reserved: 2026-07-03T03:28:09.464Z

Link: CVE-2026-14540

cve-icon Vulnrichment

Updated: 2026-07-31T16:12:44.303Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-31T02:16:29.060

Modified: 2026-08-08T00:15:26.000

Link: CVE-2026-14540

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:33:27Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)