CVE-2026-11720: Google MCP Toolbox for Databases Path Traversal in HTTP Tool URL Builder

Overview

CVE-2026-11720 affects the HTTP tool URL builder in Google MCP Toolbox for Databases. The builder inserts user-supplied path parameters into a configured tool path and then resolves the result as a relative URL. The record states that the validation covers scheme, host and user info, but the final resolution relies on ResolveReference, which normalizes dot segments. This is the root of the path traversal weakness (CWE-22).

Impact

The record describes a client being able to make the toolbox send requests to unintended endpoints on the same target host. Those requests carry the toolbox's configured credentials. The CVSS 3.1 vector from NVD indicates high confidentiality and integrity impact with no privileges or user interaction required.

Possible access to endpoints outside the operator-configured path scope.
Possible exposure of the toolbox's configured credentials to unintended endpoints.
The record does not describe availability impact.

Affected products and versions

Google MCP Toolbox for Databases, versions less than 1.3.0.
The record references a patch pull request in the upstream repository. It does not list a specific fixed release, so the first version outside the stated range is an inference.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis.

Remediation and mitigation

Identify all deployments of Google MCP Toolbox for Databases and their versions.
Plan an upgrade to a release that includes the fix referenced by the upstream patch pull request, and confirm the version with the vendor's release notes.
Until the upgrade is applied, restrict which clients can supply path parameters to tool endpoints and limit the credentials the toolbox holds for the target host.
Review the scope of configured credentials so that a traversal would expose as little as possible.

Detection guidance

Review toolbox logs for outbound requests whose resolved paths fall outside the intended tool path.
Monitor for unexpected access to administrative or sensitive endpoints on the same host using toolbox credentials.
Alert on path parameters that contain dot segments or encoded traversal characters, as a high-level signal only.

Limitations of the available information

The record does not state a specific fixed version number, the full set of affected builds, or any proof-of-concept details. The EPSS value is low at the time of the record, but it does not confirm exposure or exploitation. Whether the patch fully removes the weakness has not been verified in the sources consulted.

Frequently asked questions

What is CVE-2026-11720?

It is a path traversal vulnerability in the HTTP tool URL builder of Google MCP Toolbox for Databases. Dot segments in path parameters are normalized during URL resolution, which can move requests outside the configured path scope.

Which versions are affected?

The record lists versions less than 1.3.0. It also references a patch pull request, but it does not name a specific fixed release.

Is this vulnerability being exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted for this analysis.

What should operators do now?

Identify affected deployments, plan an upgrade to a release that includes the referenced fix, and limit the credentials and clients that can reach tool endpoints until the update is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.