GitHub Advisoryadvisory · Go

GHSA-76g7-m3xw-x9gr MCP Toolbox for Databases has an Origin Validation Error

CRITICAL Published 2026-06-13 Modified 2026-08-24 Official page ↗
Aliases
CVE-2026-11624
Ecosystem
Go
Packages
github.com/googleapis/mcp-toolbox
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-346
Reviewed
2026-08-24

Affected packages

• Go github.com/googleapis/mcp-toolbox: < 0.25.0 → fixed in 0.25.0

Description

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "*", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "*", the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.

Related

Alias · CVE (1)

  • CVE-2026-11624 The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent… vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References