CVE-2026-14537: Google Mcp Toolbox For Databases

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

Affected products

• Google Mcp Toolbox For Databases: version 1.3.0 only; version 1.4.0 only

Published 2026-07-31. Last modified 2026-08-08.