The cloud-healthcare-fhir-fetch-page component of googleapis/mcp-toolbox allows an attacker to supply an arbitrary pageURL. The tool makes an HTTP GET request to that URL using an authenticated client, and the underlying transport automatically attaches an Authorization: Bearer header to every outbound request. As a result, the attacker can receive the service-account or user access token in the response, enabling credential theft and potentially exposing protected health information. The vulnerability is a classic SSRF leading to inadvertent token exfiltration.

Google's MCP Toolbox for Databases, specifically the cloud-healthcare-fhir-fetch-page tool. No specific version information is disclosed in the advisory.

The CVSS score of 8.4 indicates a high severity flaw. The EPSS score is less than 1%, indicating a low exploitation probability, but the issue is not listed in CISA's KEV catalog. Exploitation is feasible for anyone who can invoke the tool - directly through user input or indirectly via data-driven pagination loops - since the tool unconditionally sends outgoing requests with its authentication header. The potential impact includes theft of OAuth tokens and consequent access to PHI and other GCP resources.