점검 대응높음KEV 미등록
CVE-2026-14540
Google mcp-toolbox 취약점
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or...
- 대응 우선순위
- 점검
- CVSS
- 8
- EPSS
- - 백분위 -
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.31