github.com/googleapis/mcp-toolbox vulnerabilities
CVEs whose affected-version data names the github.com/googleapis/mcp-toolbox package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-11720Critical· 9.1MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
▾ Midnightgoogleapis · github.com/googleapis/mcp-toolboxEPSS 0.53%via OSV
CVE-2026-11717Criticalgoogleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
▾ Midnightgoogleapis · github.com/googleapis/mcp-toolboxEPSS 0.18%via GHSA
CVE-2026-11718Criticalgoogleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
▾ Midnightgoogleapis · github.com/googleapis/mcp-toolboxEPSS 0.18%via GHSA
CVE-2026-11719HighMCP Toolbox for Databases: authenticated authorization bypass
MCP Toolbox for Databases: authenticated authorization bypass
▾ Twilightgoogleapis · github.com/googleapis/mcp-toolboxEPSS 0.14%via GHSA
CVE-2026-11624CriticalMCP Toolbox for Databases has an Origin Validation Error
MCP Toolbox for Databases has an Origin Validation Error
▾ Midnightgoogleapis · github.com/googleapis/mcp-toolboxEPSS 0.22%via OSV