What happened
NVD published five related mcp-toolbox CVEs on 2026-07-31, covering authorization bypass, SSRF, authentication/audience-confusion bypass, resource-exhaustion DoS, and a BigQuery dataset-scoping bypass — all in Google's official MCP Toolbox for Databases used to give LLM agents database access.
Why it matters
mcp-toolbox is Google's officially maintained MCP server for connecting agents to databases; chained together these flaws let an unauthenticated or under-scoped attacker invoke privileged database tools, pivot via SSRF into internal networks, or bypass per-tenant dataset access controls — a meaningful blast radius across any enterprise agent deployment using this toolbox for BigQuery/database access.
Attack vector
Multiple distinct flaws: (1) CVE-2026-14537 — incorrect authorization lets an unauthenticated attacker invoke scope-protected tools via legacy HTTP endpoints when --enable-api is set; (2) CVE-2026-14540 — SSRF in the generic HTTP source/tool via missing CheckRedirect policy and IP validation; (3) CVE-2026-14541 — Google OAuth provider audience-confusion authentication bypass when authService lacks explicit audience/clientId; (4) CVE-2026-14539 — unbounded memory allocation DoS via the /mcp endpoint; (5) CVE-2026-14538 — bypass of BigQuery allowedDatasets restriction via dry-run API reliance.
Affected systems
Google mcp-toolbox (googleapis/mcp-toolbox) versions 0.3.0 through 1.4.0, and up to 1.4.0 for the DoS variant
Mitigation
Upgrade mcp-toolbox past 1.4.0 per the linked GitHub PRs (3435, 3448, 3450, 3216, 3452); explicitly configure audience/clientId for Google authService; disable legacy HTTP endpoints when --enable-api is set unless required.