점검 대응높음KEV 미등록
CVE-2026-16481
Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 취약점
A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tr...
- 대응 우선순위
- 점검
- CVSS
- 8.4
- EPSS
- 0.25% 백분위 16.3% · 2026.08.03 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.28