CVE-2026-19202: Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key its cached tokens by the requested audience. Consequently, a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B). An attacker who operates, compromises, or monitors traffic to Service B can capture this token and replay it to impersonate the victim application against Service A.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to token disclosure?
Applications are exposed when they use the SDK to authenticate to two or more different audiences within the same process. The risk is highest when one audience is a sensitive service and another service is less trusted or can be observed by an attacker.
What access does an attacker need to exploit this issue?
An attacker must be able to operate, compromise, or monitor traffic to the secondary service that receives the incorrectly reused token. They can then capture the valid, unexpired token and replay it to impersonate the application to the sensitive service for which the token was originally minted.