CVE-2026-14541Disclosure(google / mcp_toolbox_for_databases)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token—even those minted for unrelated ecosystem applications—granting unauthorized clients access to protected tools and data backends.

google CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/googleapis/mcp-toolbox/pull/3450

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

mcp_toolbox_for_databases

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

google

Products

mcp_toolbox_for_databases

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14541

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-14541 An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnab... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14541
Post summary
The provided excerpt announces a new authentication bypass and audience confusion vulnerability in Google mcp-toolbox 1.4.0, offering limited technical details but no PoC, exploit code, patch, or evidence of active exploitation.
0000090
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	google	mcp_toolbox_for_databases	1.4.0	-	-

Explore more

Back to dashboard google CVEs mcp_toolbox_for_databases vulnerabilities