CVE-2026-14540 in mcp-toolbox
Summary
by MITRE • 07/31/2026
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The Server-Side Request Forgery vulnerability identified in Google mcp-toolbox versions 0.3.0 through 1.4.0 represents a critical security weakness that undermines the integrity of the tool's HTTP request handling mechanisms. This vulnerability stems from insufficient safeguards within the generic HTTP source components that process user-controlled input parameters, creating an attack surface where malicious actors can manipulate the system's behavior to make unauthorized requests. The flaw manifests specifically in the internal/sources/http/http.go file where the HTTP client initialization occurs without proper security constraints.
The technical implementation flaw lies in the absence of a restrictive CheckRedirect policy hook during HTTP client initialization and the complete lack of target IP validation mechanisms within the underlying HTTP client implementation. This design oversight allows attackers to craft malicious requests that exploit the default behavior of HTTP clients which typically follow redirects automatically without sufficient boundary checking. The vulnerability operates through user-controlled path parameters that can trigger either open redirect scenarios or direct destination swapping, effectively enabling attackers to coerce the mcp-toolbox into making requests to internal network endpoints or arbitrary external systems that would otherwise be inaccessible.
The operational impact of this vulnerability extends beyond simple data exfiltration, as it enables attackers to potentially access internal services, bypass network segmentation, and perform reconnaissance activities against internal systems. The vulnerability creates a pathway for attackers to leverage the legitimate tool's network permissions to make requests to sensitive internal endpoints such as databases, administrative interfaces, or other backend services that should not be directly accessible from the external network. This represents a significant risk in environments where the mcp-toolbox operates with elevated privileges or network access to critical infrastructure components.
Security professionals should note this vulnerability maps directly to CWE-918, which specifically addresses Server-Side Request Forgery, and aligns with ATT&CK technique T1071.004 for application layer protocol traffic switching. The risk assessment indicates this vulnerability can be exploited by both authenticated and unauthenticated attackers depending on the tool's deployment environment and access controls. Mitigation strategies should include implementing a restrictive CheckRedirect policy hook that validates redirect targets against predefined safe domains, enforcing strict IP address validation for outgoing requests, and implementing comprehensive input sanitization for all user-controlled parameters. Organizations should also consider network segmentation, firewall rules, and application-level restrictions to limit the potential impact of such vulnerabilities.
The vulnerability demonstrates a fundamental security principle failure in the tool's HTTP client implementation where defense-in-depth measures were not properly implemented. The absence of proper boundary checking and validation mechanisms creates an environment where malicious input can directly influence the system's network behavior without adequate oversight or control. This represents a classic case where insufficient security controls at the infrastructure level compound to create a significant risk exposure that can be exploited by threat actors with minimal technical expertise. Proper remediation requires both immediate code-level fixes to implement secure HTTP client initialization and long-term architectural improvements to ensure similar vulnerabilities do not exist in related components.
Organizations using affected versions of mcp-toolbox should prioritize patching or implementing compensating controls immediately, as the vulnerability can be exploited remotely without requiring special privileges beyond basic access to the tool's interface. The security implications extend to potential data breaches, unauthorized system access, and network reconnaissance activities that could lead to more severe compromise scenarios. This vulnerability serves as a reminder of the importance of secure coding practices and the critical need for comprehensive security testing, particularly for components that handle external input and network communication within application frameworks.