{"id":"GO-2026-5251","revision":"32ea5c5e883448faad80c665dcbded5e","records":[{"revision":"32ea5c5e883448faad80c665dcbded5e","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5251","aliases":["CVE-2026-11717","GHSA-8fcc-w5hv-4gxv"],"title":"googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) in github.com/googleapis/mcp-toolbox","description":"googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) in github.com/googleapis/mcp-toolbox","state":0,"publishedAt":"2026-06-25T18:43:15+00:00","modifiedAt":"2026-06-25T19:45:20.0636147+00:00","affected":[{"ecosystem":"Go","name":"github.com/googleapis/mcp-toolbox","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-8fcc-w5hv-4gxv","https://nvd.nist.gov/vuln/detail/CVE-2026-11717","https://github.com/googleapis/mcp-toolbox/pull/3341"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5251","license":"OSV · upstream source license applies","key":"osv:GO-2026-5251","identifiers":["GO-2026-5251","CVE-2026-11717","GHSA-8fcc-w5hv-4gxv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}