CVE-2026-16481: googleapis/mcp-toolbox SSRF Vulnerability

CVE-2026-16481 Overview

CVE-2026-16481 is a Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability in the cloud-healthcare-fhir-fetch-page tool of the googleapis/mcp-toolbox project. The tool accepts an unvalidated pageURL parameter from the client and issues an authenticated HTTP GET request to that destination. The underlying transport attaches an Authorization: Bearer header to every outbound request regardless of host. An attacker who controls the pageURL value can redirect the request to an external listener and capture the OAuth token or service-account access token used by Toolbox.

Critical Impact
Exfiltration of end-user OAuth tokens or service-account credentials (ADC) can expose Protected Health Information (PHI) and grant access to additional Google Cloud Platform services.

Affected Products

googleapis/mcp-toolbox — cloud-healthcare-fhir-fetch-page tool
Deployments relying on Application Default Credentials (ADC) with the affected tool
Integrations that expose the tool through Model Context Protocol (MCP) clients

Discovery Timeline

2026-07-27 - CVE-2026-16481 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16481

Vulnerability Analysis

The cloud-healthcare-fhir-fetch-page tool implements paginated retrieval of FHIR resources from the Google Cloud Healthcare API. It reads a pageURL argument supplied by the MCP client and dispatches the request through an authenticated HTTP client. The client is designed for internal Google API endpoints and attaches the caller's bearer token to every request without validating the destination. This design allows a client-supplied URL to be treated as a trusted endpoint. The flaw is classified as [CWE-918] Server-Side Request Forgery.

Root Cause

The tool does not validate or allowlist the host component of pageURL before issuing the request. The authenticated transport unconditionally attaches the Authorization: Bearer <token> header. When the destination is external, the token is transmitted to a third party. Depending on the deployment, the leaked token is either the end-user's delegated OAuth token or the broader service-account access token backing Application Default Credentials.

Attack Vector

An attacker submits an arbitrary URL to the pageURL parameter, either directly through a tool invocation payload or indirectly by poisoning data that drives the pagination loop. Toolbox then issues an authenticated GET request to the attacker-controlled host, which logs the incoming Authorization header. The stolen token can be replayed against the Cloud Healthcare API to read PHI or against other GCP services accessible to the service account. Data-driven pagination amplifies risk because the malicious URL can be embedded in FHIR resources returned by an upstream data source.

No verified proof-of-concept code is publicly available. See the GitHub pull request for the upstream fix and technical details.

Detection Methods for CVE-2026-16481

Indicators of Compromise

Outbound HTTPS or HTTP requests from Toolbox hosts to domains outside googleapis.com or approved FHIR endpoints.
Presence of Authorization: Bearer headers in traffic destined to non-Google infrastructure.
Unexpected token usage recorded in Google Cloud audit logs from IP addresses not associated with the Toolbox deployment.

Detection Strategies

Inspect Toolbox process telemetry for invocations of cloud-healthcare-fhir-fetch-page where the pageURL argument resolves to hosts outside the Cloud Healthcare API domain.
Correlate egress network flows from Toolbox workloads with an allowlist of expected Google API endpoints.
Review Cloud Audit Logs for service-account activity originating from unfamiliar user agents or geographies shortly after suspect tool calls.

Monitoring Recommendations

Enable VPC egress logging on hosts running googleapis/mcp-toolbox and alert on connections to non-Google destinations.
Track access-token usage patterns and flag sudden calls to sensitive GCP APIs from the service account tied to Toolbox.
Instrument MCP tool invocations to capture the full parameter set for offline analysis.

How to Mitigate CVE-2026-16481

Immediate Actions Required

Upgrade googleapis/mcp-toolbox to the version containing the fix merged in pull request #3453.
Rotate any OAuth tokens and service-account keys that may have been used by the affected Toolbox deployment.
Audit Cloud Healthcare and adjacent GCP service logs for unauthorized access during the exposure window.

Patch Information

The upstream fix is tracked in googleapis/mcp-toolbox pull request #3453. The patch validates the destination host of the pageURL parameter before dispatching an authenticated request, ensuring the bearer token is only sent to Cloud Healthcare API endpoints.

Workarounds

Restrict egress from Toolbox hosts to the Cloud Healthcare API domain using a firewall or service perimeter such as VPC Service Controls.
Disable or remove the cloud-healthcare-fhir-fetch-page tool from tool configurations until the patched version is deployed.
Run Toolbox with a least-privileged service account scoped only to the required FHIR store, reducing blast radius if a token is leaked.

bash

# Configuration example: restrict egress to Google Cloud Healthcare endpoints only
# Example iptables rule allowing HTTPS only to healthcare.googleapis.com resolved IPs
iptables -A OUTPUT -p tcp --dport 443 -d healthcare.googleapis.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j DROP