CVE-2026-11717

Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox (affected versions not specified)

Description An authentication bypass exists in the generic opaque token validation path validateOpaqueToken(). When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint, the software decodes the response into an introspectResp struct where the Active field is a pointer to a boolean. The system only rejects a token if the Active field is present and set to false. If the introspection endpoint response omits the mandatory active key, the internal variable remains nil, causing the validation check to short-circuit. This allows authorization tokens missing the active field to be accepted, granting unauthorized access to protected tools and data sources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.