CVE-2026-11718: An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox

Synopsis

An authentication bypass vulnerability exists in the opaque token validation logic (validateOpaqueToken) of Google MCP Toolbox for Databases (googleapis/mcp-toolbox), versions 1.3.0 and earlier. The flaw is reachable over the network with no authentication required, exploiting a logic error where a missing issuer (iss) field in an OAuth 2.0 introspection response causes issuer-checking to be silently skipped. A successful attacker can present tokens issued by unauthorized third-party identity providers and gain access as if fully authenticated, compromising confidentiality and the integrity of data the toolbox mediates. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted token to the exposed introspection-backed endpoint from any internet or intranet vantage point.

• AuthenticationNot required

  No account or credential on the target system is needed; the attacker only needs to present a token from an arbitrary third-party identity provider.

• Victim interactionNot required

  The attacker interacts directly with the service endpoint; no user action or social engineering is required.

• Attack complexityDetail

  Exploit is reliable and condition-free: the attacker simply omits the iss field from a token introspection response or uses a provider that naturally omits it, triggering the bypass consistently.

Blast Radius

• Reads any data accessible through the MCP Toolbox database connections, including stored records, credentials, and query results surfaced to the toolbox.
• Modifies or deletes database rows and other persisted data that the toolbox is authorized to write, by issuing commands under a falsely accepted identity.
• Allows an attacker to impersonate arbitrary users or service accounts by presenting tokens from unauthorized identity providers that the toolbox now silently accepts.