Skip to content
OpenAdvisories

Product · Google

mcp-toolbox

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.6
    CVE-2026-14539

    Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

    An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payl…

    Google mcp-toolbox
  • Medium 5.7
    CVE-2026-14538

    BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox

    An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relie…

    Google mcp-toolbox