Path Traversal Vulnerability in Google APIs MCP Toolbox

CVE-2026-11720

What is CVE-2026-11720?

A path traversal vulnerability has been identified in the URL builder of Google APIs MCP Toolbox, which occurs during the construction of downstream API requests. The tool's URL builder inadequately manages user-controlled parameters, allowing an attacker to introduce directory traversal sequences. This flaw enables the possibility of making unauthorized API requests to unintended endpoints within the same target host. Such exploitation can result in the unauthorized exposure of sensitive information by bypassing access restrictions that should be in place.

References