{"id":"EUVD-2026-37881","enisaUuid":"ea608e92-f46d-3f48-8952-32e99a32ba93","description":"An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.\n\nWhile the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this check. An authenticated client with low-privilege tokens (e.g., read) can bypass the intended per-tool scope restrictions and execute high-privilege tools (e.g., admin) simply by specifying an older protocol version in the MCP-Protocol-Version header, or by omitting the header entirely (which causes the server to default to the vulnerable 2024-11-05 handler).","datePublished":"Jun 18, 2026, 11:55:03 AM","dateUpdated":"Jun 18, 2026, 1:53:08 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/googleapis/mcp-toolbox/pull/3335\nhttps://github.com/googleapis/mcp-toolbox/pull/3049\n","aliases":"CVE-2026-11719\nGHSA-5gf6-gc35-xjpc\n","assigner":"Google","epss":0.15,"enisaIdProduct":[{"id":"70d9c530-6616-34d2-930f-65edef06e788","product":{"name":"MCP Toolbox for Databases (googleapis/mcp-toolbox)","vendor":{"name":"Google"}},"product_version":"1.3.0"}],"enisaIdVendor":[{"id":"b5905273-90b4-3cc3-bbe9-a002c6f072bd","vendor":{"name":"Google"}}],"enisaIdVulnerability":[{"id":"7b19fc99-4b2f-354f-9f61-5c67a91fecbc","vulnerability":{"id":"GHSA-5gf6-gc35-xjpc","description":"MCP Toolbox for Databases: authenticated authorization bypass","datePublished":"Jun 18, 2026, 3:32:02 PM","dateUpdated":"Jun 19, 2026, 5:00:02 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-11719\nhttps://github.com/googleapis/mcp-toolbox/pull/3049\nhttps://github.com/googleapis/mcp-toolbox/pull/3335\nhttps://github.com/googleapis/mcp-toolbox\n","enisa_id":"EUVD-2026-37881\n","aliases":"GHSA-5gf6-gc35-xjpc\nCVE-2026-11719\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bd5bf8a6-de02-3390-b361-056c396c928d","vulnerability":{"id":"CVE-2026-11719","description":"An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers.\n\nWhile the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRequired, older supported protocol versions (2025-06-18, 2025-03-26, and 2024-11-05) omit this check. An authenticated client with low-privilege tokens (e.g., read) can bypass the intended per-tool scope restrictions and execute high-privilege tools (e.g., admin) simply by specifying an older protocol version in the MCP-Protocol-Version header, or by omitting the header entirely (which causes the server to default to the vulnerable 2024-11-05 handler).","datePublished":"Jun 18, 2026, 11:55:03 AM","dateUpdated":"Jun 18, 2026, 1:53:08 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/googleapis/mcp-toolbox/pull/3335\nhttps://github.com/googleapis/mcp-toolbox/pull/3049\n","enisa_id":"EUVD-2026-37881\n","assigner":"Google","epss":0.15,"dataProcessed":"Nov 2, 2026, 7:13:26 AM","vulnerabilityProduct":[{"id":"3a5a2cea-03ad-35c2-9faa-02bfef956125","product":{"name":"MCP Toolbox for Databases (googleapis/mcp-toolbox)","vendor":{"name":"Google"}},"product_version":"1.3.0"}],"vulnerabilityVendor":[{"id":"bf347731-80e3-32ad-9e4f-f5129d449810","vendor":{"name":"Google"}}]}}],"enisaIdAdvisory":[]}