What happened
NVD published CVE-2026-16481 (CVSS 8.4, High) on 2026-07-27, describing an SSRF and credential-exfiltration flaw in the official Google Cloud MCP Toolbox for Databases' healthcare FHIR pagination tool. The tool forwards an attacker/agent-supplied pageURL to an authenticated Google Cloud Healthcare API client without validating the destination host.
Why it matters
MCP Toolbox for Databases is Google's widely-used (16k+ GitHub stars) open-source MCP server that lets LLM agents query structured data sources including healthcare FHIR stores. Any AI agent workflow that processes untrusted FHIR pagination links (or is prompt-injected into supplying one) can leak the service account's authenticated credentials to an attacker-controlled server — a serious blast radius given the tool is deployed in healthcare-adjacent AI agent integrations.
Attack vector
The cloud-healthcare-fhir-fetch-page tool takes an unvalidated pageURL parameter (intended to be a FHIR Bundle.entry.link.url) and issues an HTTP GET using an authenticated Google Cloud Healthcare API client. Because the tool doesn't validate that the URL points back to the legitimate FHIR store, an attacker who can influence the pageURL value (e.g., via a poisoned upstream FHIR response, prompt injection, or a malicious search result fed to the agent) can redirect the authenticated client to an arbitrary internal/external endpoint, causing SSRF and potential exfiltration of the service's OAuth credentials/tokens to an attacker-controlled server.
Affected systems
googleapis/mcp-toolbox (MCP Toolbox for Databases), cloud-healthcare-fhir-fetch-page tool
Mitigation
Upgrade to the patched release fixing PR #3453 in googleapis/mcp-toolbox; validate that pageURL matches the expected FHIR store host/pattern before dispatching authenticated requests.