Authorization Bypass Vulnerability in MCP Toolbox for Databases by Google

CVE-2026-11719

What is CVE-2026-11719?

An authorization bypass vulnerability has been identified in the MCP Toolbox for Databases due to inadequate scope enforcement in older protocol handlers. This flaw allows an authenticated user with low-privilege access to circumvent per-tool restrictions and execute high-privilege tools. Specifically, users can exploit this by utilizing outdated protocol versions in the MCP-Protocol-Version header or by omitting the header, which forces the server to revert to a vulnerable version. This security gap presents risks as it enables unauthorized access to advanced functionalities intended for higher-privilege roles.

References