DNS Rebinding Vulnerability in Google APIs Toolkit

CVE-2026-9739

What is CVE-2026-9739?

This vulnerability allows attackers to exploit DNS rebinding attacks when users interact with the Google APIs Toolkit via Server-Sent Events (SSE). Despite implementing security measures such as allowed-origins and allowed-hosts flags during the beta phase, a critical oversight led to the retention of a hardcoded Access-Control-Allow-Origin: * header in the SSE initialization handler. This security flaw specifically affects users utilizing the Toolbox with SSE under version v2024-11-05, posing significant risks to data privacy and integrity.

References