CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
Attackers can use path traversal in URL construction to access unauthorized endpoints and leak credentials on the target host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11720?
CVE-2026-11720 is a critical path traversal vulnerability in MCP Toolbox for Databases (googleapis/mcp-toolbox), published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox.
When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured path scope. This allows the client to coerce the toolbox into making requests to unintended endpoints on the same target host while forwarding the toolbox's configured credentials (e.g., bypassing a restricted path like /api/v1/users/{{.id}} to reach /admin/secrets).
Weakness: CWE-22
Which versions are affected by CVE-2026-11720?
3 open source packages ship an affected version, including github.com/googleapis/mcp-toolbox. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/googleapis/mcp-toolbox Go | All versions | 1.3.0 |
github.com/googleapis/mcp-toolbox Go | All versions | 1.3.0 |
github.com/googleapis/mcp-toolbox Go | All versions | 1.3.0 |
Products include Google Mcp Toolbox for Databases.
How do I fix CVE-2026-11720?
Upgrade github.com/googleapis/mcp-toolbox to 1.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-11720 being exploited?
There is no known exploitation of CVE-2026-11720 in the wild and no public exploit code.
Other vulnerabilities in MCP Toolbox for Databases (googleapis/mcp-toolbox)
- CVE-2026-11717 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
- CVE-2026-11718 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
- CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox
- CVE-2026-11719 MCP Toolbox for Databases: authenticated authorization bypass
- CVE-2026-14537 Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
Sources
Also known as GHSA-vwxw-jrg6-9jxv, GO-2026-6411.