CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
Attackers can capture and replay cached Google ID tokens intended for one service against another, leading to impersonation and unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19202?
CVE-2026-19202 is a critical vulnerability in Google mcp-toolbox-sdk-python, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key its cached tokens by the requested audience. Consequently, a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B). An attacker who operates, compromises, or monitors traffic to Service B can capture this token and replay it to impersonate the victim application against Service A.
Weakness: CWE-524
Which versions are affected by CVE-2026-19202?
How do I fix CVE-2026-19202?
No fix has been published for CVE-2026-19202 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19202 being exploited?
There is no known exploitation of CVE-2026-19202 in the wild and no public exploit code.
Sources
Also known as GHSA-jcjp-gr26-563j.