A hardcoded Access‑Control‑Allow‑Origin: * header in the Server‑Side‑Events (SSE) initialization handler for Google MCP Toolbox for Databases allows DNS rebinding attacks when users connect via SSE under specification v2024‑11‑05. Based on the description, the attacker can manipulate the DNS resolution of the client to redirect the browser to arbitrary destinations after the initial connection, causing the browser to issue requests to malicious servers while still trusting the Toolbox endpoint. This bypasses the same‑origin policy and can lead to unintended data exposure or unauthorized manipulation of database operations.

Google MCP Toolbox for Databases, beta period. The vulnerability affects users connecting with SSE using the v2024‑11‑05 specification. No other product versions are indicated as impacted.

With a CVSS score of 9.4 the vulnerability is of high severity. EPSS data is not available and the issue is not listed in CISA KEV. Based on the description, the likely attack vector requires an attacker who can control DNS for a target domain to force a client using Toolbox to rebind the origin after the initial request. Because the tool exposes a wildcard Access‑Control‑Allow‑Origin header, the browser will accept cross‑site requests, making the attack plausible and impactful for any user who runs Toolbox in a browser environment.