CVE-2026-14541: Google mcp-toolbox Auth Bypass Vulnerability

CVE-2026-14541 Overview

CVE-2026-14541 is an authentication bypass and audience confusion vulnerability in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. The toolbox then accepts any valid Google OAuth access token, including tokens minted for unrelated ecosystem applications. Unauthorized clients gain access to protected tools and data backends served through the Model Context Protocol (MCP) interface. The flaw is classified as improper authentication [CWE-287].

Critical Impact
Any valid Google OAuth token from any Google-integrated application can be replayed against a vulnerable mcp-toolbox instance to access protected tools and backend data.

Affected Products

Google mcp-toolbox version 1.4.0
Deployments using the Google OAuth authService with mcpEnabled: true
Configurations lacking an explicit audience or clientId parameter

Discovery Timeline

2026-07-31 - CVE-2026-14541 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14541

Vulnerability Analysis

The vulnerability resides in the ValidateMCPAuth pipeline that processes opaque Google OAuth access tokens. When developers initialize the Google authService with mcpEnabled: true and omit an explicit audience or clientId, the pipeline bypasses the audience validation step. The toolbox verifies only that the presented token is a syntactically valid, unexpired Google OAuth access token. It does not confirm that the token was minted for the specific mcp-toolbox deployment.

Opaque OAuth tokens do not carry structured claims like JSON Web Tokens (JWTs). Validation therefore depends on introspection against Google's token info endpoint and explicit comparison of the returned audience or client ID with a configured expected value. Skipping that comparison collapses the trust boundary between distinct OAuth clients.

Root Cause

The root cause is missing audience enforcement in an authentication code path that assumes a safe default when configuration is absent. Rather than failing closed when no audience or clientId is supplied, the pipeline proceeds and accepts the token. This design places the security guarantee on operator configuration rather than on the library itself.

Attack Vector

An attacker who obtains any valid Google OAuth access token, for example one issued to an unrelated third-party application the victim uses, can send that token as a bearer credential to the vulnerable mcp-toolbox endpoint. The toolbox accepts the token and authorizes access to MCP tools and connected data backends. Exploitation requires no privileges on the toolbox itself and no user interaction with the toolbox operator. See the fix in GitHub Pull Request #3450 for the corrective implementation.

Detection Methods for CVE-2026-14541

Indicators of Compromise

Successful MCP tool invocations from OAuth client_id values that do not match the expected application identity
Introspection log entries showing tokens with audiences unrelated to the mcp-toolbox deployment being accepted
Access to protected tools from source IPs or user agents inconsistent with the sanctioned client population

Detection Strategies

Enable verbose logging on the authService and correlate each accepted token with its aud or azp field returned from Google's token info endpoint
Alert on any mcp-toolbox configuration where mcpEnabled: true is set without a corresponding audience or clientId value
Review MCP request audit trails for token subjects that have never previously interacted with the deployment

Monitoring Recommendations

Ingest mcp-toolbox authentication and MCP tool invocation logs into a centralized SIEM for baseline analysis
Track the distribution of OAuth client identifiers across accepted requests and alert on new or unexpected identifiers
Monitor outbound calls from mcp-toolbox to backend data sources for volume or pattern deviations following authentication events

How to Mitigate CVE-2026-14541

Immediate Actions Required

Inventory all Google mcp-toolbox deployments and identify any running version 1.4.0 with mcpEnabled: true
Configure an explicit audience or clientId in every Google authService initialization to force audience validation
Rotate any credentials or data that may have been exposed through unauthenticated tool access
Restrict network exposure of mcp-toolbox endpoints to trusted clients until configuration is corrected

Patch Information

The corrective change is tracked in GitHub Pull Request #3450 in the googleapis/mcp-toolbox repository. Upgrade to a release that incorporates this fix and re-verify that audience validation is enforced for opaque tokens in the ValidateMCPAuth pipeline.

Workarounds

Set an explicit clientId or audience value on the Google authService so the pipeline performs the audience comparison
Place mcp-toolbox behind a reverse proxy that independently validates the OAuth token audience before forwarding requests
Disable mcpEnabled on deployments that do not require MCP tool access until the toolbox is upgraded

bash

# Configuration example: enforce audience validation on the Google authService
# Replace the placeholder with the OAuth client ID issued for this deployment
export MCP_TOOLBOX_AUTH_CLIENT_ID="<your-oauth-client-id>.apps.googleusercontent.com"
export MCP_TOOLBOX_AUTH_AUDIENCE="$MCP_TOOLBOX_AUTH_CLIENT_ID"
export MCP_TOOLBOX_MCP_ENABLED="true"