CVE-2026-11720: Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder

Synopsis

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox (Google MCP Toolbox for Databases). The flaw is reachable over the network with no authentication required: an attacker supplies crafted dot-segment sequences (../) in path parameters, which are normalized by the Go ResolveReference step, causing the toolbox to issue requests to unintended endpoints on the same target host while forwarding its configured credentials. Successful exploitation gives an attacker read and write access to backend API endpoints outside the operator-configured path scope, such as administrative or secrets endpoints. A patched-image rebuild at version 1.3.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable URL builder is exposed over the network, so an attacker must be able to send HTTP requests to the toolbox service to supply malicious path parameters.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no account or credential is needed to submit the crafted path parameters that trigger the traversal.

• Victim interactionNot required

  The CVSS vector specifies UI:N, so exploitation is fully automated and requires no action from any user or operator.

• Attack complexityDetail

  The CVSS vector specifies AC:L and AT:N, meaning the exploit is reliable and condition-free with no special timing, race conditions, or environmental prerequisites required.

Blast Radius

• An attacker reads responses from backend API endpoints outside the operator-configured path scope, including administrative routes and secrets endpoints, using the toolbox's own forwarded credentials.
• An attacker writes to or modifies resources on those unintended endpoints on the same target host, such as creating or overwriting records exposed by admin APIs.
• Forwarded credentials captured or misused during traversal requests may be replayed independently, extending access beyond the immediate toolbox session.