| id: GO-2026-6411 |
| modules: |
| - module: github.com/googleapis/mcp-toolbox |
| versions: |
| - fixed: 1.3.0 |
| vulnerable_at: 1.2.0 |
| summary: MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox |
| cves: |
| - CVE-2026-11720 |
| ghsas: |
| - GHSA-vwxw-jrg6-9jxv |
| references: |
| - advisory: https://github.com/advisories/GHSA-vwxw-jrg6-9jxv |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-11720 |
| - fix: https://github.com/googleapis/mcp-toolbox/commit/80a66021205e032a424fff87b3dc6d92da58aa77 |
| - fix: https://github.com/googleapis/mcp-toolbox/pull/3218 |
| - web: https://github.com/googleapis/mcp-toolbox/releases/tag/v1.3.0 |
| source: |
| id: GHSA-vwxw-jrg6-9jxv |
| created: 2026-09-09T13:17:40.481445-04:00 |
| review_status: UNREVIEWED |
