Description
A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox.

The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.
Published: 2026-07-27
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Credential exfiltration via SSRF can expose service-account or user OAuth tokens and may lead to unauthorized access to PHI and other Google Cloud services
Action: Patch Immediately
AI Analysis

Impact

The cloud-healthcare-fhir-fetch-page component of googleapis/m arbitrary pageURL. The tool makes an HTTP GET request to that URL using an authenticated client, and the underlying transport automatically attaches an Authorization: Bearer header to every outbound request. As a result, the attacker can receive the service-account or user access token in the response, enabling credential theft and potentially exposing protected health information. The vulnerability is a classic SSRF leading to inadvertent token exfiltration.

Affected Systems

Google's MCP Toolbox for Databases, specifically the cloud-healthcare-fhir-fetch-page tool. No specific version information is disclosed in the advisory.

Risk and Exploitability

The CVSS score of 6 indicates a moderate severity flaw. The EPSS score is less than 1%, indicating a low exploitation probability, but the issue is not listed in CISA's KEV catalog. Exploitation is feasible for anyone who can invoke the tool – directly through user input or indirectly via data-driven pagination sends outgoing requests with its authentication header. The potential impact includes theft and other GCP resources.

Generated by OpenCVE AI on September 11, 2026 at 05:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update googleapis/mcp-toolbox to the latest release that includes the fix for unvalidated pageURL handling (see pull request 3453 for reference).
  • Configure network egress rules or firewall policies to restrict outbound traffic from systems running the tool to only trusted internal endpoints, blocking unsolicited outbound connections to arbitrary hosts.
  • Run the tool with the least-privileged service account, limiting the scopes to only those necessary for the task and avoiding broad permissions that could be abused if tokens are leaked.

Generated by OpenCVE AI on September 11, 2026 at 05:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N'}

 cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N'}

Tue, 28 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google mcp Toolbox For Databases
Vendors & Products Google
Google mcp Toolbox For Databases

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.
Title Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Google Mcp Toolbox For Databases
cve-icon MITRE

Status: PUBLISHED

Assigner: Google

Published:

Updated: 2026-09-10T16:06:44.182Z

Reserved: 2026-07-21T14:56:59.820Z

Link: CVE-2026-16481

cve-icon Vulnrichment

Updated: 2026-07-27T19:35:48.081Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-27T19:17:14.970

Modified: 2026-09-10T17:17:01.973

Link: CVE-2026-16481

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T05:45:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)