CVE-2026-11720: Google MCP Toolbox Path Traversal Flaw

CVE-2026-11720 Overview

CVE-2026-11720 is a path traversal vulnerability [CWE-22] in the HTTP tool URL builder of Google's googleapis/mcp-toolbox, also known as MCP Toolbox for Databases. The URL builder substitutes user-controlled pathParams into the configured tool path, then parses the result as a relative URL and resolves it with Go's ResolveReference. Because dot segments are normalized during resolution, an attacker can inject ../ sequences to escape the operator-configured path scope. The toolbox then forwards its configured credentials to unintended endpoints on the same target host.

Critical Impact
A remote, unauthenticated attacker can coerce the toolbox into issuing authenticated requests to arbitrary paths on the downstream host, exposing sensitive administrative endpoints such as /admin/secrets.

Affected Products

Google MCP Toolbox for Databases (googleapis/mcp-toolbox)
HTTP tool source configurations using pathParams substitution
Deployments forwarding operator-configured credentials to downstream APIs

Discovery Timeline

2026-06-29 - CVE-2026-11720 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-11720

Vulnerability Analysis

The MCP Toolbox exposes HTTP tools whose paths are defined by an operator, for example /api/v1/users/{{.id}}. Clients invoking the tool supply values for the templated parameters. The URL builder interpolates those values and constructs a relative URL that is then joined to the configured base URL using net/url.ResolveReference.

The builder validates that the interpolated input does not modify the scheme, host, or user-info components. It does not, however, reject or neutralize path traversal sequences before resolution. Go's URL resolver normalizes .. segments per RFC 3986, collapsing them and allowing the effective request path to move above the configured scope.

The toolbox then sends the request with any credentials the operator attached to the tool source, such as bearer tokens or API keys. This grants the caller an authenticated request primitive against arbitrary paths on the same host.

Root Cause

The root cause is missing canonicalization of path parameters before URL resolution. The builder trusts that scheme, host, and user-info checks are sufficient to keep the request within the configured path scope, but relative resolution with dot segments defeats that assumption.

Attack Vector

Exploitation requires only the ability to invoke a configured HTTP tool. An attacker submits a pathParams value such as ..%2F..%2Fadmin%2Fsecrets or ../../admin/secrets. After interpolation and resolution, the outbound request targets an endpoint outside the operator's intended scope while still carrying the toolbox's credentials. No authentication to the downstream service is required from the attacker because the toolbox supplies it.

The vulnerability is described in the maintainer fix at googleapis/mcp-toolbox PR #3218. No public proof-of-concept has been published.

Detection Methods for CVE-2026-11720

Indicators of Compromise

Outbound HTTP requests from the MCP Toolbox to paths not defined in any configured tool, particularly administrative endpoints.
Tool invocation logs containing ../, ..%2F, %2e%2e%2f, or other encoded traversal sequences in pathParams values.
Downstream API access logs showing toolbox-originated requests to /admin, /internal, or similar restricted routes.

Detection Strategies

Parse toolbox request logs and flag any resolved request path that does not match the operator-configured template prefix.
Alert on decoded path parameter values containing .., backslashes, or repeated URL-encoding of . and /.
Correlate toolbox egress traffic with downstream server logs to identify credentialed requests to unexpected endpoints.

Monitoring Recommendations

Enable verbose request logging on the MCP Toolbox and forward logs to a centralized analytics platform for path-scope analysis.
Instrument downstream APIs to log the caller identity, source, and full requested path for every authenticated request originating from the toolbox.
Establish a baseline of legitimate resolved paths per tool and alert on deviations.

How to Mitigate CVE-2026-11720

Immediate Actions Required

Upgrade googleapis/mcp-toolbox to a release containing the fix from PR #3218.
Audit configured HTTP tool sources and revoke or rotate any credentials that may have been exposed to unintended endpoints.
Restrict downstream credentials to the minimum scope needed by each tool, so a traversal cannot reach sensitive routes.

Patch Information

The upstream fix is delivered in googleapis/mcp-toolbox pull request #3218, which reworks path parameter handling so that dot segments cannot escape the configured tool path. Deploy the patched build to all toolbox instances and restart the service.

Workarounds

Disable HTTP tools that accept user-controlled pathParams until the patched version is deployed.
Place the toolbox behind an egress proxy that enforces an allow-list of exact downstream paths for each tool.
Reject any tool invocation whose parameter values contain .., %2e%2e, \, or other traversal indicators at an upstream API gateway.

bash

# Example egress allow-list enforcement using a reverse proxy rule
# Deny any toolbox-originated request whose path contains traversal sequences
location / {
    if ($request_uri ~* "(\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    proxy_pass http://downstream_api;
}