Google Vulnerabilities and Affected Products
Vulnerabilities associated with MCP Toolbox for Databases.
Products
Clear product- Chrome4,306 vulnerabilities
- Android1,376 vulnerabilities
- pixel56 vulnerabilities
- Chromium V839 vulnerabilities
- ChromeOS12 vulnerabilities
- android_kernel6 vulnerabilities
- AngularJS6 vulnerabilities
- Chromium6 vulnerabilities
- gRPC6 vulnerabilities
- MCP Toolbox for Databases (googleapis/mcp-toolbox)6 vulnerabilities
- mcp-toolbox5 vulnerabilities
- gVisor4 vulnerabilities
- Keras4 vulnerabilities
- Nearby3 vulnerabilities
- admob2 vulnerabilities
- Andrioid2 vulnerabilities
- Chromium Blink2 vulnerabilities
- Chromium Intents2 vulnerabilities
- Chromium Mojo2 vulnerabilities
- Chromium Skia2 vulnerabilities
- Fuchsia2 vulnerabilities
- libjxl2 vulnerabilities
- MCP Toolbox for Databases2 vulnerabilities
- Nest Wifi Pro2 vulnerabilities
- Omaha2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-11624CRITICAL | Generated title:Google MCP Toolbox for Databases Origin Validation Bypass via DNS RebindingThe Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "*", allowing users to implement strict access controls as needed without… CWE-346Jun 13, 2026 | CVSS9.4v4.0 | EPSS0.153% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-9739CRITICAL | MCP Toolbox for Databases vulnerable to DNS rebinding attacksVulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05. CWE-942May 27, 2026 | CVSS9.4v4.0 | EPSS0.279% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |