CVE-2026-9739

During the beta phase in MCP Toolbox, `allowed-origins` and `allowed-hosts` flags were introduced to protect against unauthorized access in accordance with MCP security guidelines. However, a hardcoded `Access-Control-Allow-Origin: *` header remained in the SSE initialization handler, which was not covered by this protection. An attacker can exploit this vulnerability through a DNS rebinding attack — a technique that manipulates DNS resolution so that a malicious website gains access to the victim's local resources. This requires user interaction (e.g., visiting a malicious website), after which the attacker can communicate with the local Toolbox instance via SSE.

An attacker can gain unauthorized access to the victim's MCP Toolbox instance, potentially reading, modifying data, or executing commands in the context of connected tools — both on the client side and dependent systems (high impact on confidentiality, integrity, and availability in both scopes).

Apply patches available from the vendor according to the references — a fix is available in the pull request https://github.com/googleapis/mcp-toolbox/pull/3054. Until the update is applied, it is recommended to restrict network access to the MCP Toolbox instance and avoid exposing SSE endpoints on untrusted network interfaces.

Users connecting through Toolbox using SSE according to the v2024-11-05 specification; specific versions indicated in the vendor's references (https://github.com/googleapis/mcp-toolbox/issues/3053)