{"id":"CVE-2026-11719","title":"MCP Toolbox for Databases: authenticated authorization bypass","summary":"MCP Toolbox for Databases: authenticated authorization bypass","severity":"high","cwe":["CWE-862"],"vendor":"googleapis","product":"github.com/googleapis/mcp-toolbox","ecosystem":"go","affected":["github.com/googleapis/mcp-toolbox < 1.4.0"],"patched":["github.com/googleapis/mcp-toolbox 1.4.0"],"published":"2026-06-18","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5gf6-gc35-xjpc","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11719"},{"url":"https://github.com/googleapis/mcp-toolbox/pull/3049"},{"url":"https://github.com/googleapis/mcp-toolbox/pull/3335"},{"url":"https://github.com/advisories/GHSA-5gf6-gc35-xjpc"}],"tags":["ghsa","go"],"epss":0.00145,"epssPercentile":0.04154,"ingestedAt":"2026-06-29T14:31:46.955Z","slug":"CVE-2026-11719","body":"## Overview\n\nAn authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.\n\nWhile the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this check. An authenticated client with low-privilege tokens (e.g., read) can bypass the intended per-tool scope restrictions and execute high-privilege tools (e.g., admin) simply by specifying an older protocol version in the MCP-Protocol-Version header, or by omitting the header entirely (which causes the server to default to the vulnerable 2024-11-05 handler).\n\n## Affected packages\n\n- `github.com/googleapis/mcp-toolbox < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/googleapis/mcp-toolbox 1.4.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}