CVE-2026-14537 | CyberRota

CyberRota Analysis

AI-Generated

The direct HTTP API tool invocation endpoint in Google mcp-toolbox versions 1.3.0 and 1.4.0 is vulnerable due to incorrect authorization, allowing unauthenticated attackers to access tools that should be restricted. This vulnerability can lead to unauthorized tool execution, potentially compromising the integrity and security of the system. Organizations using these specific versions of mcp-toolbox should prioritize patching to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-14537

Severity

CRITICAL

CVSS

9.8

EPSS

0.22%

Original NVD Description

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-58704 HIGH CVE-2026-87658 MEDIUM CVE-2026-87657 LOW CVE-2026-87656 MEDIUM CVE-2026-87655 MEDIUM CVE-2026-87654 CRITICAL