Security Advisory

CVE-2026-14537

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-31 01:38:18

Last updated 2026-07-31 16:08:17

Assigner Google

CVSS score not scored

State PUBLISHED

Description

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

← Browse all CVEs View on cve.org ↗