Loading...
Skip to main content
GeekWala

CVE-2026-11718 — Vulnerability in...

CRITICAL

googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)

Published June 18, 2026Updated June 25, 2026Source: osv

Summary

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response into an introspectResp struct. However, the subsequent claim-checking logic (validateClaims) evaluates the issuer condition as if a.issuer != "" && iss != "". If the external OAuth provider's introspection response omits the optional iss (issuer) field completely, the variable iss defaults to an empty string. This causes the conditional block to evaluate to false and be skipped silently. Consequently, the application accepts tokens issued by unauthorized or unintended third-party identity providers.

Advisory Timeline

  • First published June 18, 2026 (116 days ago).
  • Last revised June 25, 2026 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/googleapis/mcp-toolbox to 1.4.0 or later
go get github.com/googleapis/mcp-toolbox@v1.4.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/googleapis/mcp-toolbox
go
All versions1.4.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-287
    Improper AuthenticationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-11718?
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-11718?
CVE-2026-11718 affects github.com/googleapis/mcp-toolbox. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-11718 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-wcpr-6g7x-p44r
GO-2026-5706

Related CVEs

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies