CVE-2026-16481
Received Received - Intake

SSRF and Credential Exfiltration in MCP Toolbox

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Google Inc.

Description
A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-28
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-16481
EUVD
EUVD-2026-49407

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
googleapis mcp-toolbox *
googleapis mcp_toolbox to 2026-06-18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool accepts an unvalidated pageURL parameter and sends an HTTP GET request to it using an authenticated client. The Authorization header with OAuth/service-account tokens is automatically attached to every request, even to external URLs. Attackers can exploit this by providing a malicious URL, causing the tool to send its access tokens to an attacker-controlled server, potentially exposing Protected Health Information (PHI) and Google Cloud Platform services.

Detection Guidance

To detect this SSRF vulnerability, monitor outbound HTTP requests from your system to external domains, especially those carrying Authorization headers. Check logs for requests to unexpected hosts or unusual patterns in the pageURL parameter. Use network monitoring tools like tcpdump or Wireshark to inspect traffic for OAuth token leakage.

Impact Analysis

If you use the affected tool, an attacker could steal your OAuth or service-account access tokens by tricking the tool into sending requests to their server. This could lead to unauthorized access to your Protected Health Information (PHI) or other sensitive data in Google Cloud Platform services. The impact depends on the permissions of the stolen tokens.

Compliance Impact

This vulnerability could lead to unauthorized access to Protected Health Information (PHI), which directly violates HIPAA requirements for safeguarding patient data. It may also result in non-compliance with GDPR if personal data of EU citizens is exposed. Organizations using this tool risk regulatory penalties, legal liabilities, and reputational damage due to data breaches.

Mitigation Strategies

Immediately update to the latest version of googleapis/mcp-toolbox that includes the validateFHIRPageURL method. Disable or restrict access to the cloud-healthcare-fhir-fetch-page tool if not essential. Review and revoke any exposed OAuth tokens or service account credentials that may have been leaked.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart