CVE-2026-16481: mcp toolbox for databases from 0.19.1 (inclusive), before 1.5.0 (exclusive); +1 more affected products

CVE-2026-16481. CVSS 3.1 base score 7.5 (HIGH, NVD). EPSS 0.00193 (percentile 0.08461), scored 22-Oct-2026.

Affected technology

mcp toolbox for databases · from 0.19.1 (inclusive), before 1.5.0 (exclusive)
google

MCP Toolbox for Databases (googleapis/mcp-toolbox) · 0.19.1 through 1.4.0
Google

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Vendor/CNA’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 24-Oct-2026 15:08 UTC

CWE: CWE-918
CCR priority: 30.0 /100 (P4)
CVSS 3.1: 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · NVD
EPSS: 0.00193 · percentile 0.08455 · 2026-10-24
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-24 15:09:16.138216+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-24 15:07:27.951960+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-16481.html