CVE-2026-11717: Google MCP Toolbox for Databases: authentication bypass in opaque token introspection

Overview

CVE-2026-11717 affects the generic opaque token validation routine (validateOpaqueToken) in googleapis/mcp-toolbox, catalogued as Google MCP Toolbox for Databases. When the toolbox validates an opaque token against an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into a structure where the Active field is a nullable boolean pointer. The code rejects a token only when that field is present and explicitly false. If the introspection response omits the mandatory "active" key entirely, the check is skipped and the token is accepted. The weakness is classified as CWE-287 (Improper Authentication).

Impact

NVD rates the issue 9.1 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and the CNA (Google) assigns a CVSS 4.0 score of 9.3. According to the description, accepting tokens without the "active" field grants access to protected tools and the underlying data sources. In practice this can expose high-confidentiality and high-integrity impact on databases reachable through the toolbox. Exploitability likely depends on the introspection endpoint's behavior: the condition is triggered when the endpoint returns a payload lacking "active", for example through a non-compliant, misconfigured or error-path response.

Affected products and versions

Google MCP Toolbox for Databases (googleapis/mcp-toolbox): versions from 1.0.0 up to and including 1.3.0.

Only deployments that use the generic opaque token introspection path are expected to be exposed; this scoping is an inference from the description.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score was available in the record.

Remediation and mitigation

Apply the fix referenced in pull request 3341 by upgrading to a release that includes it. The record does not name a specific fixed version, so confirm with the project's release notes.
Verify that your OAuth 2.0 introspection endpoint always returns the "active" field as required by RFC 7662, including on error paths.
Until patched, restrict network access to the toolbox to trusted clients and apply least-privilege credentials to the data sources it connects to.
Consider placing an authenticating gateway in front of the toolbox that independently validates tokens.

Detection guidance

Review introspection endpoint logs for responses that lack the "active" key and correlate them with successful tool invocations in toolbox logs.
Monitor database audit logs for queries originating from the toolbox that do not map to known users or sessions.
Inventory deployments running versions 1.0.0 through 1.3.0 that have opaque token validation enabled.

Limitations of the available information

The record does not specify a fixed release version, does not include an EPSS score or SSVC assessment, and provides a single reference (the patch pull request). Details about which introspection providers might omit the "active" field are not provided.

Frequently asked questions

What causes CVE-2026-11717?

The opaque token validation code only rejects tokens when the introspection response explicitly sets "active" to false; if the field is missing, the token is accepted.

Which versions are affected?

Google MCP Toolbox for Databases versions 1.0.0 through 1.3.0 are listed as affected.

Is it being exploited?

It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

How do I fix it?

Upgrade to a release containing the fix from pull request 3341 and ensure your introspection endpoint always returns the "active" field.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.