Server-side request forgery via unrestricted HTTP redirection in MCP Toolbox
The HTTP source in Google's MCP Toolbox followed redirects without validating where they led, so a crafted path parameter could make the server call internal or arbitrary external endpoints.
- Reference
- CVE-2026-14540
- Rating
- 8.0 High (CVSS 4.0, assigned by Google)
- Class
- CWE-918, server-side request forgery
- CVE record
- Published 2026-07-31 by Google as CNA
- Affected
- mcp-toolbox 0.3.0 through 1.4.0
- Credit
- Syed Anas Mohiuddin, finder
- Fix merged
- 2026-06-18, googleapis/mcp-toolbox PR #3448
What was wrong
The generic HTTP source and tool components of mcp-toolbox, versions 0.3.0 through 1.4.0, used an HTTP client with no restrictive redirect policy and no check on the target IP address.
A user-controlled path parameter could trigger an open redirect or a direct destination swap on the backend. The toolbox then followed the redirect and made the request, to an internal address or any external one.
Why it matters for agents
An MCP tool is called by a model, and the model reads untrusted text. A malicious data-driven prompt can supply the parameter, so the attacker does not need direct access to the toolbox. The server's network position becomes the attacker's.
The fix
Google merged googleapis/mcp-toolbox PR #3448 on 2026-06-18. It adds an SSRFGuard that protects against DNS rebinding (time-of-check to time-of-use) attacks, configurable boundaries for private networks and IP ranges, and an early check of the configured base URL at initialization.
The merged PR carries the line "Reported by: Syed Anas Mohiuddin", and the CVE record lists the same name as finder.