Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-O…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-9739 · Microsoft / collected KEV context

EUVD-2026-32672

GHSA-7pf3-8xx7-rvhf

GO-2026-5870

cve-program · CVE-2026-9739

• https://github.com/googleapis/mcp-toolbox/issues/3053
• https://github.com/googleapis/mcp-toolbox/pull/3054

euvd · EUVD-2026-32672

• https://github.com/googleapis/mcp-toolbox/issues/3053
• https://github.com/googleapis/mcp-toolbox/pull/3054

nvd · CVE-2026-9739

• https://github.com/googleapis/mcp-toolbox/issues/3053
• https://github.com/googleapis/mcp-toolbox/pull/3054

osv · GHSA-7pf3-8xx7-rvhf

• https://nvd.nist.gov/vuln/detail/CVE-2026-9739
• https://github.com/googleapis/mcp-toolbox/issues/3053
• https://github.com/googleapis/mcp-toolbox/pull/3054
• https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae
• https://github.com/googleapis/mcp-toolbox

osv · GO-2026-5870

• https://github.com/advisories/GHSA-7pf3-8xx7-rvhf
• https://nvd.nist.gov/vuln/detail/CVE-2026-9739
• https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae
• https://github.com/googleapis/mcp-toolbox/pull/3054
• https://github.com/googleapis/mcp-toolbox/issues/3053

No related operational record is retained in the current change model.