PT-2026-66663 · Google · Mcp-Toolbox

David Carliez

+1

·

CVE-2026-14537

·

Published

2026-07-31

·

Updated

2026-08-08

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions 1.3.0 through 1.4.0
Description Incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature. This occurs when tool invocation requests are sent through legacy HTTP endpoints while the --enable-api flag is active.
Recommendations For versions 1.3.0 through 1.4.0, disable the --enable-api flag to prevent unauthorized tool invocation via legacy HTTP endpoints.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-14537

Affected Products

Mcp-Toolbox