CVE-2026-14540

Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions 0.3.0 through 1.4.0

Description A Server-Side Request Forgery (SSRF) issue exists in the generic HTTP source and tool components. The HTTP client in internal/sources/http/http.go does not safely regulate request redirection boundaries because it is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker can provide a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, forcing the software to make unauthorized requests to internal or arbitrary external endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.