CVE-2026-9739 MCP Toolbox for Databases vulnerable to DNS rebinding attacks
Attackers can bypass origin restrictions via DNS rebinding due to a hardcoded wildcard CORS header in the SSE handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-9739?
CVE-2026-9739 is a critical vulnerability in Google MCP Toolbox for Databases, published on 27 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.
Weakness: CWE-942
Which versions are affected by CVE-2026-9739?
3 open source packages ship an affected version, including github.com/googleapis/mcp-toolbox.
| Package | Affected | Fixed in |
|---|---|---|
github.com/googleapis/mcp-toolbox Go | All versions | 1.2.0 |
github.com/googleapis/mcp-toolbox Go | All versions | 1.2.0 |
github.com/googleapis/mcp-toolbox Go | All versions | 1.2.0 |
How do I fix CVE-2026-9739?
Upgrade github.com/googleapis/mcp-toolbox to 1.2.0 or later.
Is CVE-2026-9739 being exploited?
There is no known exploitation of CVE-2026-9739 in the wild and no public exploit code.
Sources
Also known as GHSA-7pf3-8xx7-rvhf, GO-2026-5870.