CVE-2026-14537 in mcp-toolbox
Summary
by MITRE • 07/31/2026
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability resides within Google mcp-toolbox versions 1.3.0 and 1.4.0 where an incorrect authorization flaw exists in the direct HTTP API tool invocation endpoint. This weakness allows unauthenticated attackers to bypass authentication mechanisms that should normally require proper authorization tokens or credentials for accessing protected tools. The vulnerability specifically manifests when the --enable-api flag is activated, creating a pathway for malicious actors to exploit legacy HTTP endpoints that were not properly secured against unauthorized access attempts.
The technical implementation of this flaw stems from improper validation of authentication states within the API endpoint handling logic. When the enable-api flag is active, the system fails to enforce proper authorization checks before processing tool invocation requests, despite the presence of scopeRequired features designed to protect sensitive operations. This misconfiguration effectively creates a backdoor where any external party can submit tool invocation commands through HTTP requests without needing valid authentication credentials, essentially undermining the intended security model that should govern access to protected functions.
The operational impact of this vulnerability is significant as it enables attackers to execute arbitrary tool invocations against systems running vulnerable mcp-toolbox versions. An unauthenticated attacker could potentially leverage this weakness to perform unauthorized operations, data exfiltration, system manipulation, or other malicious activities depending on the capabilities of the tools exposed through the API endpoints. The vulnerability affects organizations that have enabled the API functionality while maintaining older toolbox versions, creating a persistent risk vector that can be exploited without requiring prior access credentials or privileged accounts.
This issue aligns with CWE-285, which addresses improper authorization within software systems, and maps to ATT&CK technique T1078 for valid accounts and T1566 for phishing, as the vulnerability enables attackers to bypass authentication controls through legitimate API pathways. Organizations should immediately upgrade to patched versions of mcp-toolbox to remediate this weakness, while also implementing network segmentation and access controls around API endpoints that remain active but unpatched. Additional mitigations include disabling the --enable-api flag when not required, implementing proper rate limiting on API endpoints, and conducting regular security assessments to identify similar authorization flaws in other system components that may be vulnerable to similar exploitation patterns.