CVE-2026-14537: Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google mcp-toolboxto a version that resolves this vulnerability.Fixed in v1.3.0 - Upgrade
Upgrade
Google mcp-toolboxto a version that resolves this vulnerability.Fixed in v1.4.0 - Configuration
If using legacy HTTP endpoints, disable the API exposure by not activating the --enable-api flag to prevent unauthenticated tool invocation requests from reaching the legacy HTTP API endpoint.
Google mcp-toolbox --enable-api = disable - Compensating control
Ensure the legacy HTTP endpoints used by the direct HTTP API tool invocation endpoint are not reachable from unauthenticated networks (e.g., restrict network access to trusted clients only) while the authorization bypass is addressed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14537?
The severity of CVE-2026-14537 is rated at 80, indicating a critical risk to affected systems.
What systems are affected by CVE-2026-14537?
CVE-2026-14537 affects Google mcp-toolbox versions v1.3.0 and v1.4.0.
How do I fix CVE-2026-14537?
To fix CVE-2026-14537, upgrade Google mcp-toolbox to a version that does not include the vulnerability.
What type of vulnerability is CVE-2026-14537?
CVE-2026-14537 is classified as an authorization bypass vulnerability.
How can CVE-2026-14537 be exploited?
An unauthenticated attacker can exploit CVE-2026-14537 by invoking tools protected by the scopeRequired feature through legacy HTTP endpoints.