CVE-2026-14540 Overview
CVE-2026-14540 is a Server-Side Request Forgery (SSRF) vulnerability in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. The underlying HTTP client in internal/sources/http/http.go initializes without a restrictive CheckRedirect policy and omits target IP validation. Attackers or malicious data-driven prompts can supply a crafted path parameter that triggers an open redirect or destination swap. The toolbox then follows the redirection and issues unauthorized requests to internal services or arbitrary external endpoints. The flaw is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated network attackers can pivot mcp-toolbox into internal networks, reach cloud metadata services, and exfiltrate sensitive backend responses through redirect abuse.
Affected Products
- Google mcp-toolbox version 0.3.0
- Google mcp-toolbox versions 0.4.0 through 1.3.x
- Google mcp-toolbox version 1.4.0
Discovery Timeline
- 2026-07-31 - CVE-2026-14540 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-14540
Vulnerability Analysis
The mcp-toolbox exposes generic HTTP source and tool components that let Model Context Protocol (MCP) clients invoke backend HTTP endpoints. The toolbox sanitizes user-controlled parameters at the input layer, giving the appearance of safe request construction. However, the enforcement stops at the request boundary and does not extend to subsequent HTTP responses. When a backend returns a redirect, the Go http.Client follows it by default because no CheckRedirect hook restricts the destination. This design gap turns a benign-looking outbound call into an attacker-controlled request.
Root Cause
The HTTP client in internal/sources/http/http.go is instantiated without a CheckRedirect policy and without validating the resolved target IP address. Standard Go redirect handling therefore transparently follows 3xx responses to any host, including link-local, loopback, and RFC 1918 ranges. The absence of an allow-list or SSRF-aware resolver means that redirection targets bypass the input sanitization performed on the initial user parameter.
Attack Vector
An attacker supplies a crafted path parameter or influences a prompt so that the toolbox issues a request to an attacker-controlled endpoint. That endpoint returns an HTTP redirect pointing at an internal resource such as a cloud metadata service, an internal admin API, or a service on the local network. The toolbox follows the redirect and returns the response body to the calling MCP client. Because the initial request originates from the toolbox's trusted network position, internal ACLs treat it as legitimate.
No verified public exploitation code is available. Technical remediation context is documented in the upstream fix pull request.
Detection Methods for CVE-2026-14540
Indicators of Compromise
- Outbound HTTP requests from mcp-toolbox processes to link-local addresses such as 169.254.169.254 or to RFC 1918 ranges that are not part of expected backend inventory.
- Repeated 3xx responses in toolbox logs followed by requests to hosts outside the configured source allow-list.
- Unexpected access to cloud instance metadata endpoints from container or workload identities associated with the toolbox.
Detection Strategies
- Instrument the toolbox process with egress logging and alert on any DNS resolution or TCP connection that resolves to internal, loopback, or metadata addresses.
- Correlate MCP prompt inputs containing URL-like strings or absolute paths with subsequent outbound HTTP traffic from the toolbox host.
- Baseline the set of legitimate backend hosts the toolbox contacts and alert on deviations, including redirect chains that terminate outside the baseline.
Monitoring Recommendations
- Forward toolbox stdout, stderr, and HTTP client debug logs to a central log store and retain redirect target headers.
- Enable flow logs on the subnet or namespace hosting mcp-toolbox and monitor for connections to 169.254.0.0/16, 127.0.0.0/8, and other reserved ranges.
- Alert on 401, 403, and 200 responses from internal admin services whose source is the toolbox service account.
How to Mitigate CVE-2026-14540
Immediate Actions Required
- Upgrade mcp-toolbox to a release later than 1.4.0 that includes the fix delivered in pull request #3448.
- Restrict egress from the toolbox host or container to an explicit allow-list of backend hostnames and block metadata and RFC 1918 destinations.
- Audit MCP tool definitions and remove or restrict generic HTTP sources that accept caller-controlled paths or URLs.
Patch Information
The upstream fix introduces a CheckRedirect policy and target validation in the HTTP client. Apply the update tracked in googleapis/mcp-toolbox PR #3448 and redeploy affected toolbox instances. Verify the running version reports a build newer than 1.4.0 before returning the service to production.
Workarounds
- Front the toolbox with an egress proxy that rejects redirects and enforces a destination allow-list.
- Configure network policies or security groups to deny toolbox traffic to 169.254.169.254, loopback, and internal management subnets.
- Disable or remove generic HTTP tool definitions until the patched release is deployed.
# Example egress restriction using iptables on the toolbox host
iptables -A OUTPUT -m owner --uid-owner mcp-toolbox -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-toolbox -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-toolbox -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp-toolbox -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
