CVE-2026-14541

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token—even those minted for unrelated ecosystem applications—granting unauthorized clients access to protected tools and data backends.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/googleapis/mcp-toolbox/pull/3450	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:mcp_toolbox_for_databases:1.4.0:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una omisión de autenticación y vulnerabilidad de confusión de audiencia existe en el componente proveedor de Google OAuth de Google mcp-toolbox versión 1.4.0. Cuando un Google authService se inicializa con mcpEnabled: true pero carece de una audiencia o clientId definidos explícitamente, la pipeline ValidateMCPAuth para tokens opacos omite la validación de audiencia por completo. Como resultado, la caja de herramientas aceptará cualquier token de acceso de Google OAuth válido -incluso aquellos acuñados para aplicaciones de ecosistemas no relacionadas-, otorgando a clientes no autorizados acceso a herramientas protegidas y backends de datos.

Information

Published : 2026-07-31 03:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-14541

Mitre link : CVE-2026-14541

CVE.ORG link : CVE-2026-14541

JSON object : View

Products Affected

google

mcp_toolbox_for_databases

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-14541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T16:14:40.882881Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@google.com", "affectedData": [{"vendor": "Google", "product": "mcp-toolbox", "versions": [{"status": "affected", "version": "1.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T03:16:24.170", "references": [{"url": "https://github.com/googleapis/mcp-toolbox/pull/3450", "tags": ["Issue Tracking", "Patch"], "source": "cve-coordination@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token\u2014even those minted for unrelated ecosystem applications\u2014granting unauthorized clients access to protected tools and data backends."}, {"lang": "es", "value": "Una omisi\u00f3n de autenticaci\u00f3n y vulnerabilidad de confusi\u00f3n de audiencia existe en el componente proveedor de Google OAuth de Google mcp-toolbox versi\u00f3n 1.4.0. Cuando un Google authService se inicializa con mcpEnabled: true pero carece de una audiencia o clientId definidos expl\u00edcitamente, la pipeline ValidateMCPAuth para tokens opacos omite la validaci\u00f3n de audiencia por completo. Como resultado, la caja de herramientas aceptar\u00e1 cualquier token de acceso de Google OAuth v\u00e1lido -incluso aquellos acu\u00f1ados para aplicaciones de ecosistemas no relacionadas-, otorgando a clientes no autorizados acceso a herramientas protegidas y backends de datos."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:mcp_toolbox_for_databases:1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "397F70F8-C2B7-4832-A335-7CCA8BF3C7B8"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@google.com"}