CVE-2026-9739 json
MCP Toolbox for Databases vulnerable to DNS rebinding attacks
published 5mo ago modified 16d ago also EUVD-2026-32672 , GHSA-7pf3-8xx7-rvhf , GO-2026-5870
- cvss
- 9.4
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.
Patch / fix
- go github.com/googleapis/mcp-toolbox 1.2.0
- Google MCP Toolbox for Databases PR 3054 (Fix CORS bypass)
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/googleapis/mcp-toolbox@c4c7bd9 commit
- github.com/googleapis/mcp-toolbox#3054 pull request
Is CVE-2026-9739 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/googleapis/mcp-toolbox | <1.2.0 |
1.2.0 |
Affected products
- Google MCP Toolbox for Databases
Classification
- Weakness
-
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
References
-
github.com
/googleapis/mcp-toolbox/pull/3054
web, patch
-
github.com
/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae
web, patch
-
github.com
/googleapis/mcp-toolbox/issues/3053
web, report
-
nvd.nist.gov
/vuln/detail/CVE-2026-9739
advisory
-
github.com
/googleapis/mcp-toolbox
package
-
github.com
/advisories/GHSA-7pf3-8xx7-rvhf
advisory
Sources
- CVE List CVE-2026-9739
- GitHub Advisory GHSA-7pf3-8xx7-rvhf
- NVD CVE-2026-9739
- OSV GO-2026-5870
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.