Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequi…

Critical CVSS 9.8

CVECVE-2026-14537

First seen2026-08-08 03:16 UTC

Disclosed2026-07-31 02:16 UTC

Last updated2026-08-08 03:16 UTC

Channel statusauto

Summary

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://github.com/googleapis/mcp-toolbox/pull/3435 Issue Tracking

Timeline

2026-08-08 nvd_ingest NVD