CVE-2026-11718: Google MCP Toolbox for Databases: authentication bypass in opaque token issuer validation

Overview

CVE-2026-11718 is an authentication bypass in the generic opaque token validation path (validateOpaqueToken) of Google MCP Toolbox for Databases (googleapis/mcp-toolbox). When the toolbox validates an opaque token against an OAuth 2.0 introspection endpoint (RFC 7662), the claim-checking logic only enforces the expected issuer when both the configured issuer and the issuer returned in the response are non-empty. Because the iss field is optional in introspection responses, a provider that omits it causes the issuer check to be skipped without any error. The weakness is classified as CWE-287 (Improper Authentication).

Impact

NVD rates the issue 9.1 (Critical) under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; the CNA (Google) assigned a CVSS 4.0 score of 9.3. According to the description, the toolbox may accept tokens issued by unauthorized or unintended third-party identity providers. Since MCP Toolbox brokers access to database tools, a bypass of issuer validation could plausibly let a caller holding a token from a different provider reach protected tools and data, with high impact on confidentiality and integrity as reflected in the vector.

Affected products and versions

Google MCP Toolbox for Databases, versions ≥ 1.0.0 and ≤ 1.3.0

Only deployments that use opaque token validation via an introspection endpoint are described as exposed; the record does not state a specific fixed release number.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

Apply the fix from googleapis/mcp-toolbox pull request 3360, or upgrade to a release that includes it once confirmed by the project.
Review which authorization servers your introspection endpoint trusts; if the endpoint validates tokens from multiple issuers, restrict it or configure it to always return the iss field.
Where possible, prefer validation modes that strictly bind tokens to a single expected issuer and audience.
Limit network exposure of the toolbox to trusted clients until patched.

Detection guidance

Inventory MCP Toolbox deployments and check their versions against the affected range.
Inspect introspection responses from your OAuth provider to determine whether they include the iss claim; absence indicates exposure on unpatched versions.
Review authentication and tool-invocation logs for sessions associated with unexpected clients, subjects or identity providers.

Limitations of the available information

The record does not name a fixed version, does not include an EPSS score or SSVC assessment, and does not describe which identity providers omit the iss field. Details on the scope of the fix are only available in the referenced pull request.

Frequently asked questions

Which versions of MCP Toolbox for Databases are affected?

The record lists versions ≥ 1.0.0 and ≤ 1.3.0 of Google MCP Toolbox for Databases.

Is CVE-2026-11718 being exploited in the wild?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What triggers the bypass?

An OAuth 2.0 introspection response that omits the optional iss field causes the issuer check to be skipped, so tokens from unintended identity providers may be accepted.

How do I fix it?

Apply the fix from googleapis/mcp-toolbox pull request 3360 or upgrade to a release that includes it, and ensure your introspection endpoint returns the iss field or trusts only the intended issuer.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.