GHSA-76g7-m3xw-x9gr

Source

https://github.com/advisories/GHSA-76g7-m3xw-x9gr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-76g7-m3xw-x9gr/GHSA-76g7-m3xw-x9gr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-76g7-m3xw-x9gr

Aliases

Published

2026-06-13T12:31:25Z

Modified

2026-09-10T03:50:48Z

Severity

9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

MCP Toolbox for Databases has an Origin Validation Error

Details

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "", the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.

Database specific

{
    "cwe_ids":  [
        "CWE-346"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-24T22:06:17Z",
    "nvd_published_at":  "2026-06-13T10:16:17Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/googleapis/mcp-toolbox

Package

Name: github.com/googleapis/mcp-toolbox; View open source insights on deps.dev
Purl: pkg:golang/github.com/googleapis/mcp-toolbox

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.25.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-76g7-m3xw-x9gr/GHSA-76g7-m3xw-x9gr.json"