https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:07:54.995431+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-14537 CVE-2026-14537 — Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints 2026-10-08T16:07:55.013602+00:00

Affected: Google mcp-toolbox

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active.