CVE-2026-14537 Overview
CVE-2026-14537 is an incorrect authorization vulnerability [CWE-863] in Google mcp-toolbox versions v1.3.0 and v1.4.0. The flaw resides in the direct HTTP API tool invocation endpoint. An unauthenticated remote attacker can invoke tools that should be protected by the scopeRequired feature. Exploitation requires sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active. The vulnerability affects confidentiality, integrity, and availability of protected tool operations exposed through the Model Context Protocol (MCP) toolbox.
Critical Impact
Unauthenticated attackers can invoke tools protected by scopeRequired when the --enable-api flag is active, bypassing intended authorization controls on legacy HTTP endpoints.
Affected Products
- Google mcp-toolbox version v1.3.0
- Google mcp-toolbox version v1.4.0
- Deployments running with the --enable-api flag active
Discovery Timeline
- 2026-07-31 - CVE-2026-14537 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-14537
Vulnerability Analysis
The mcp-toolbox project exposes tools that can be invoked through Model Context Protocol interfaces. The scopeRequired feature enforces authorization checks so that only clients holding the required scope may invoke sensitive tools. In versions v1.3.0 and v1.4.0, this authorization enforcement is inconsistent across invocation paths. The direct HTTP API tool invocation endpoint, enabled through the --enable-api flag, does not consistently apply the scopeRequired check. Requests routed through these legacy HTTP endpoints reach tool execution logic without prior authorization validation. This allows an unauthenticated attacker to trigger tools that were intended to require specific OAuth scopes or equivalent credentials.
Root Cause
The root cause is an authorization gap between the primary MCP tool invocation path and the legacy direct HTTP API path. The scopeRequired policy is applied on one code path but omitted on the other. Because both paths share underlying tool execution logic, the enforcement inconsistency permits authorization bypass. This is a classic [CWE-863] Incorrect Authorization defect, where a security check is present but not uniformly reached across all entry points.
Attack Vector
An attacker with network access to a vulnerable mcp-toolbox deployment sends crafted HTTP requests to the legacy tool invocation endpoints exposed by the --enable-api flag. No authentication material or valid scope claim is required. The attacker specifies the target tool name and parameters in the request body. The service executes the tool as if the caller were authorized, returning results and any side effects the tool produces. Exploitation requires no user interaction and can be automated at scale against exposed instances. Full technical context is available in the GitHub Pull Request 3435.
Detection Methods for CVE-2026-14537
Indicators of Compromise
- Unexpected tool invocations in mcp-toolbox logs originating from clients without associated OAuth scope claims or authentication headers.
- HTTP requests to legacy tool invocation paths on services started with the --enable-api flag.
- Tool execution events for scopeRequired-protected tools with no preceding successful authorization event.
- Anomalous outbound activity, data access, or downstream API calls triggered by invoked tools.
Detection Strategies
- Inspect application logs for tool invocation events lacking a corresponding scope validation entry.
- Correlate HTTP access logs with the tool execution timeline to identify unauthenticated invocation attempts.
- Baseline the expected callers of each scopeRequired tool and alert on deviations.
- Deploy web application firewall or reverse proxy rules that log or block requests to the legacy --enable-api endpoints.
Monitoring Recommendations
- Monitor process startup arguments across hosts to inventory instances running with --enable-api active.
- Track version metadata to identify mcp-toolboxv1.3.0 and v1.4.0 deployments still in production.
- Alert on any HTTP 200 response from tool invocation endpoints when no authenticated session preceded the request.
How to Mitigate CVE-2026-14537
Immediate Actions Required
- Upgrade mcp-toolbox to a fixed release that includes the changes in Pull Request 3435.
- Disable the --enable-api flag on any deployment where the legacy HTTP API is not required.
- Restrict network access to mcp-toolbox instances to trusted callers using firewall rules or a reverse proxy enforcing authentication.
- Audit tool invocation logs for the exposure window to identify any unauthorized executions.
Patch Information
The fix is tracked in googleapis/mcp-toolbox Pull Request 3435, which extends the scopeRequired authorization check to the direct HTTP API tool invocation endpoint. Operators running v1.3.0 or v1.4.0 should upgrade to the patched release. Confirm after upgrade that both the MCP and legacy HTTP paths enforce the required scope.
Workarounds
- Start mcp-toolbox without the --enable-api flag until the patched release is deployed.
- Place the service behind an authenticating reverse proxy that rejects unauthenticated requests to tool invocation paths.
- Remove or disable tools that use the scopeRequired feature until authorization enforcement is verified across all endpoints.
# Configuration example: start mcp-toolbox without the vulnerable legacy API
# Remove the --enable-api flag from service definitions
mcp-toolbox serve --address 127.0.0.1:5000
# If --enable-api is required, restrict exposure at the network layer
iptables -A INPUT -p tcp --dport 5000 ! -s 10.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
