Google Mcp Toolbox For Databases — CVE-2026-11720 (Critical)

Date Jun 29, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Google · Mcp Toolbox For Databases

CVE CVE-2026-11720

Critical vendor advisory CVE-2026-11720

Summary

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL resolution. Because dot segments (../) are normalized during this resolution step, an attacker can supply path parameters containing directory traversal sequences to escape the operator-configured pat

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.1) in Google Mcp Toolbox For Databases. Patch or mitigate promptly. EPSS percentile: 29%.

Operator check

Review CVE-2026-11720 in your asset inventory. Apply patches per vendor guidance and verify Mcp Toolbox For Databases is not exposed. CVSS score: 9.1. EPSS probability: 0.4%; percentile: 29%.

Sources

NVD — CVE-2026-11720 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed