What’s Vulnerable › Vulnerabilities
CVE-2026-11720: Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-29 · updated 2026-10-25
- Weakness: CWE-22
Description
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).
Affected products
- Google MCP Toolbox for Databases (googleapis/mcp-toolbox): before 1.3.0 — fixed in 1.3.0
How to fix
Upgrade to a fixed version: Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.3.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-11720 or the next vulnerability affects your stack