Vulnerabilities CVE-2026-14537

CVE-2026-14537

High

Open

TLP:CLEAR

Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

Details

CVSS Score: 8.1
EPSS Score ⓘ: 0.22%

12.4th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Confidence: 90%
Published: Jul 31, 2026
Last Modified: Jul 31, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.