CVE-2026-9739: Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790)

Synopsis

DNS rebinding combined with a CORS bypass vulnerability affects Google MCP Toolbox for Databases when clients connect via Server-Sent Events (SSE) under specification v2024-11-05. The SSE initialization handler incorrectly retains a hardcoded 'Access-Control-Allow-Origin: *' header, overriding the intended 'allowed-origins' and 'allowed-hosts' restrictions and exposing the service to any origin over the network without authentication. A successful attack gives an adversary full read, write, and availability impact on both the vulnerable component and any connected systems. A patched-image rebuild at PR 3054 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SSE endpoint over the network; the service is exposed remotely, making it accessible to any network-reachable client including browsers executing cross-origin requests.

• AuthenticationNot required

  No credentials are needed; the misconfigured wildcard CORS header allows any origin to initiate SSE connections without presenting authentication material.

• Victim interactionRequired

  The attack requires a user to visit or be directed to a malicious page that initiates the DNS rebinding sequence, making browser-side victim interaction a necessary step in the exploit chain.

• Attack complexityDetail

  Exploit conditions are reliable and condition-free; no race conditions, specific memory layouts, or unusual environmental prerequisites are required to carry out the attack.

Blast Radius

• Reads sensitive data from the database-connected service, including query results, session context, and any credentials or tokens accessible through the Toolbox API.
• Modifies or deletes persisted data via unauthorized write operations routed through the compromised SSE connection.
• Crashes or degrades the MCP Toolbox service, disrupting database access for all dependent applications.
• Pivots laterally to connected systems (SC:H/SI:H/SA:H) by leveraging the Toolbox's trusted database credentials to reach backend data stores beyond the immediate container.