CVE-2026-14537 in mcp-toolboxinformation

Résumé

par MITRE • 31/07/2026

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

Google

Réserver

03/07/2026

Divulgation

31/07/2026

Modérer

accepté

Entrée

VDB-384982

CPE

prêt

EPSS

0.00000

KEV

non

Activités

faible

Secteur

Telecommunication, Finance, ...

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-14537
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-14537
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-14537/

◂ PrécédentAperçuSuivant ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!