---
id: CVE-2026-11719
title: 'MCP Toolbox for Databases: authenticated authorization bypass'
summary: 'MCP Toolbox for Databases: authenticated authorization bypass'
severity: high
cwe:
  - CWE-862
vendor: googleapis
product: github.com/googleapis/mcp-toolbox
ecosystem: go
affected:
  - github.com/googleapis/mcp-toolbox < 1.4.0
patched:
  - github.com/googleapis/mcp-toolbox 1.4.0
published: '2026-06-18'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5gf6-gc35-xjpc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11719'
  - url: 'https://github.com/googleapis/mcp-toolbox/pull/3049'
  - url: 'https://github.com/googleapis/mcp-toolbox/pull/3335'
  - url: 'https://github.com/advisories/GHSA-5gf6-gc35-xjpc'
tags:
  - ghsa
  - go
epss: 0.00145
epssPercentile: 0.03121
ingestedAt: '2026-06-29T14:31:46.955Z'
---

## Overview

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.

While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this check. An authenticated client with low-privilege tokens (e.g., read) can bypass the intended per-tool scope restrictions and execute high-privilege tools (e.g., admin) simply by specifying an older protocol version in the MCP-Protocol-Version header, or by omitting the header entirely (which causes the server to default to the vulnerable 2024-11-05 handler).

## Affected packages

- `github.com/googleapis/mcp-toolbox < 1.4.0`

## Remediation

Upgrade to a patched release:

- `github.com/googleapis/mcp-toolbox 1.4.0`