CVE-2026-14537 — Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints

CVE-2026-14537

Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints PUBLISHED

Description (CNA)

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

Affected (CNA)

Vendor / product	Versions
Google / mcp-toolbox	affected 1.3.0; affected v1.4.0

CWE

CWE-863

References

https://github.com/googleapis/mcp-toolbox/pull/3435

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.