PatchTheCVEmcp toolbox for databases vulnerabilities and fixes
Recent CVEs affecting mcp toolbox for databases, with upgrade or downgrade steps. 6 tracked.
Also searched as: mcptoolboxfordatabases.
mcp toolbox for databases has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-07-31. Highest priority: CVE-2026-14537 (score 46/100).
- CVE-2026-16481 HIGH 7.5 UPGRADE A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-
- CVE-2026-14537 CRITICAL 9.8 DOWNGRADE Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0
- CVE-2026-14541 HIGH 7.5 DOWNGRADE An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of
- CVE-2026-14539 HIGH 7.5 UPGRADE An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox ve
- CVE-2026-14538 HIGH 7.7 UPGRADE An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool componen
- CVE-2026-14540 MEDIUM 6.1 UPGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Go
FAQ
How do I fix mcp toolbox for databases vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mcp toolbox for databases being exploited right now?
None of the tracked mcp toolbox for databases CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mcp toolbox for databases CVE should I patch first?
CVE-2026-14537 currently ranks highest (46/100): Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 .