CVE-2026-14541 in mcp-toolbox
Summary
by MITRE • 07/31/2026
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token—even those minted for unrelated ecosystem applications—granting unauthorized clients access to protected tools and data backends.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
This vulnerability represents a critical authentication bypass flaw in Google mcp-toolbox version 1.4.0 that stems from improper audience validation during the OAuth authentication process. The issue manifests when the Google authService component is configured with mcpEnabled: true but without explicit audience or clientId parameters, creating a dangerous gap in the security model that allows for cross-application token reuse. The vulnerability specifically affects the ValidateMCPAuth pipeline where opaque tokens are processed, enabling attackers to exploit the missing audience validation check and gain unauthorized access to protected resources.
The technical root cause of this vulnerability aligns with CWE-287 which addresses improper authentication issues, and more specifically relates to CWE-345 Insufficient Verification of Data Authenticity. When mcpEnabled is set to true without explicit audience or clientId configuration, the system defaults to skipping audience validation entirely rather than enforcing proper token binding. This design flaw creates a scenario where the toolbox accepts any valid Google OAuth access token regardless of its intended audience, effectively breaking the core principle of audience restriction that should prevent tokens from being used across different applications or services within the Google ecosystem.
The operational impact of this vulnerability is severe and multifaceted, potentially allowing attackers to escalate privileges and gain unauthorized access to sensitive backend systems and data. An attacker could obtain a valid OAuth token for any legitimate Google application and then use it against the mcp-toolbox service, effectively bypassing authentication mechanisms that should prevent cross-application token reuse. This creates a pathway for privilege escalation attacks where unauthorized users can access protected tools, manipulate data, and potentially compromise entire backend infrastructures. The vulnerability is particularly dangerous because it operates silently without logging or alerting administrators to the unauthorized access attempts.
From an ATT&CK framework perspective, this vulnerability maps to T1078 Valid Accounts and T1566 Phishing, as it enables attackers to leverage legitimate OAuth tokens for unauthorized access. The flaw also relates to T1213 Data from Information Repositories where attackers could extract sensitive data through unauthorized access to backend systems. Organizations using Google mcp-toolbox version 1.4.0 are at significant risk of compromise, particularly in environments where multiple applications share the same authentication infrastructure. The vulnerability's impact extends beyond simple access control to potentially enable lateral movement within networks and persistence mechanisms.
The recommended mitigations include immediate patching of the mcp-toolbox component to version 1.4.1 or later where this vulnerability has been addressed, implementing explicit audience validation rules for all Google authService configurations, and establishing mandatory configuration parameters that require audience or clientId specification. Organizations should also implement monitoring for unauthorized authentication attempts and conduct regular security audits of their OAuth configurations. Additionally, implementing principle of least privilege access controls and token binding mechanisms can help reduce the impact if similar vulnerabilities are discovered in other components of the system architecture.