CVE-2026-19202 Overview
CVE-2026-19202 is a caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK. The module-level token cache does not key cached Google ID tokens by the requested audience. When an application authenticates to two or more audiences within the same process, a token minted for one service can be returned from the cache and transmitted to a different service. An attacker who operates, compromises, or observes traffic to the secondary service captures the cached token and replays it against the original sensitive service, impersonating the victim application. The flaw is tracked under CWE-524 (Use of Cache Containing Sensitive Information).
Critical Impact
An attacker controlling or monitoring any downstream audience reachable by the SDK can capture a Google ID token minted for a more privileged audience and replay it to impersonate the victim application.
Affected Products
- mcp-toolbox-sdk-python — Python SDK for the MCP Toolbox
- toolbox-core package within the SDK
- Applications using the SDK to authenticate to two or more Google audiences in the same process
Discovery Timeline
- 2026-09-22 - CVE-2026-19202 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-19202
Vulnerability Analysis
The toolbox-core package maintains a module-level cache for Google ID tokens obtained during authenticated calls. Google ID tokens are audience-scoped: the aud claim binds the token to a specific target service, and the receiving service is expected to validate that claim. The SDK cache stores a token after the first successful mint but does not include the requested audience in the cache key. Subsequent authentication requests to different audiences within the same process retrieve the previously cached token instead of minting a new one for the correct audience.
The result is a cross-audience token leak. Sensitive tokens intended only for high-privilege services are transmitted to lower-trust or attacker-controlled services that appear in the same authentication flow.
Root Cause
The cache implementation uses a key that omits the audience parameter. Because token identity is defined by the (principal, audience) tuple, ignoring the audience collapses distinct tokens into a single cache entry. The first token minted in the process persists in cache until expiry and is returned to every subsequent caller regardless of the audience they requested.
Attack Vector
An attacker who controls, compromises, or passively monitors traffic to any service (Service B) that the victim application authenticates to using the SDK can capture the incoming ID token. If the cached token was originally minted for a more sensitive service (Service A), the aud claim still names Service A. The attacker replays the token to Service A, which accepts it as valid because signature, expiry, and audience validation all succeed. The attacker impersonates the victim application against Service A until the token expires. No user interaction is required, and the attack is executed over the network.
No verified public exploit code is available. See the upstream fix in Pull Request #675 for the corrective change.
Detection Methods for CVE-2026-19202
Indicators of Compromise
- Google ID tokens presented to Service B whose aud claim names a different, more sensitive service such as Service A.
- Successful authentications to a sensitive Google-audience service from unexpected client IPs or user agents that previously interacted with a lower-trust service.
- Repeated identical jti or token fingerprints observed across multiple distinct backend services within the same token lifetime.
Detection Strategies
- Enable strict aud claim validation on every service consuming Google ID tokens and log all mismatches.
- Correlate outbound authentication events from applications embedding toolbox-core against the intended audience per call site.
- Inventory Python processes importing toolbox_core and flag any that authenticate to more than one Google audience.
Monitoring Recommendations
- Alert on token replay: the same token signature reaching two or more distinct service endpoints.
- Monitor Google Cloud audit logs for authentications to privileged services originating from workloads that should not hold those credentials.
- Track SDK version telemetry across the fleet and alert on any process running an unpatched toolbox-core release.
How to Mitigate CVE-2026-19202
Immediate Actions Required
- Upgrade mcp-toolbox-sdk-python to the release that incorporates Pull Request #675.
- Rotate or revoke any Google service credentials whose ID tokens may have been transmitted to unintended audiences.
- Audit downstream services that received traffic from applications embedding the SDK and confirm strict aud validation is enforced.
Patch Information
The upstream fix introduces audience-aware cache keying so that each (principal, audience) pair maintains its own token entry. Review the change in GitHub Pull Request #675 and pin dependencies to the patched release across all Python environments and container images.
Workarounds
- Disable the module-level token cache if the SDK exposes a configuration flag, forcing a fresh token mint per call.
- Isolate each Google audience into a separate process so a shared module-level cache cannot serve tokens across audiences.
- Enforce short token lifetimes and require the receiving service to reject tokens whose aud claim does not match its own identity.
# Upgrade the affected package to the patched release
pip install --upgrade mcp-toolbox-sdk-python
# Verify the installed version
pip show mcp-toolbox-sdk-python
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.