He Wei

**Name of the Vulnerable Software and Affected Versions** Google mcp-toolbox versions 1.3.0 through 1.4.0 **Description** Incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature. This occurs when tool invocation requests are sent through legacy HTTP endpoints while the `--enable-api` flag is active. **Recommendations** For versions 1.3.0 through 1.4.0, disable the `--enable-api` flag to prevent unauthorized tool invocation via legacy HTTP endpoints.

**Name of the Vulnerable Software and Affected Versions** Google mcp-toolbox versions 0.16.1 through 1.4.0 **Description** An improper authorization and security-boundary bypass exists in the bigquery-execute-sql tool component. The system uses the BigQuery dry-run API to enforce dataset restrictions; however, a fail-open logic flaw occurs when the API returns an empty array for specialized constructs, allowing authenticated attackers to bypass `allowedDatasets` validation checks. This enables the extraction of structural DDL (Data Definition Language) schemas for excluded datasets through INFORMATION SCHEMA and provides access to downstream federated row data via EXTERNAL QUERY connections. **Recommendations** Update Google mcp-toolbox to a version later than 1.4.0.

**Name of the Vulnerable Software and Affected Versions** Google mcp-toolbox versions prior to 1.4.1 **Description** A resource allocation issue in the HTTP handler component allows an unauthenticated attacker to cause a denial of service (DoS). The '/mcp' endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop `io.ReadAll()` without applying defensive constraints like `http.MaxBytesReader` or pre-read Content-Length enforcement. An attacker can consume available host memory by submitting a single, massive HTTP request body until the process is terminated by an Out-Of-Memory (OOM) error, which occurs when the system cannot allocate more memory to the process. **Recommendations** Update to a version newer than 1.4.0. As a temporary mitigation, restrict access to the '/mcp' endpoint to trusted sources only.

**Name of the Vulnerable Software and Affected Versions** Google mcp-toolbox version 1.4.0 **Description** An authentication bypass and audience confusion issue exists in the Google OAuth provider component. When a Google authService is initialized with `mcpEnabled`: true but lacks an explicitly defined audience or `clientId`, the ValidateMCPAuth pipeline for opaque tokens skips audience validation. This allows the toolbox to accept any valid Google OAuth access token, including those created for unrelated ecosystem applications, which may grant unauthorized clients access to protected tools and data backends. **Recommendations** Explicitly define the audience or `clientId` when initializing the Google authService with `mcpEnabled`: true for version 1.4.0.

**Name of the Vulnerable Software and Affected Versions** MISP (affected versions not specified) **Description** An incorrect authorization issue allows an organization administrator to target site administrator accounts within the same organization using the administrative email functionality. The system fails to exclude accounts with the site administrator role from recipient queries, enabling an organization administrator to perform privileged account-management actions, such as initiating a password reset workflow, against higher-privileged accounts. Successful exploitation can lead to account takeover, privilege escalation, and full compromise of the instance's confidentiality, integrity, and availability. The attacker must be authenticated as an organization administrator in the same organization as the target site administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.