What happened
NVD published CVE-2026-19202 (~CVSS 9.1 per seed) on 2026-09-22: a caching flaw in the toolbox-core package of Google's MCP Toolbox SDK reuses the same Google ID token across different audiences because the module-level cache does not key by requested audience, so a token for a sensitive service is delivered to another service and is replayable for impersonation.
Why it matters
This is an AI SDK credential-handling flaw in the MCP/agentic tooling layer: the token identity of the agent application is silently reusable across trust boundaries, enabling cross-service impersonation of the agent's Google identity — exactly the class of credential-boundary failure that compounds in agent ecosystems where one process calls many tools/services.
Attack vector
The SDK's toolbox-core caches Google ID tokens keyed without the requested audience; when the same process requests tokens for multiple audiences, the cached (valid, unexpired) token for Service A is handed to Service B. An attacker who operates or monitors Service B collects the token and replays it against Service A to impersonate the application/MCP caller.
Affected systems
Google mcp-toolbox-sdk-python (toolbox-core package token cache), vulnerable versions fixed by PR #675
Mitigation
Apply the fix in googleapis/mcp-toolbox-sdk-python PR #675 (key cached tokens by audience / drop cross-audience reuse) and upgrade the SDK; rotate any ID tokens that may have been handed to unexpected audiences; avoid single-process multi-audience auth flows until patched.