CVE-2026-19202

Received Received - Intake

Token Reuse in mcp-toolbox-sdk-python Toolbox-core

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Google Inc.

Description

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache fails to key its cached tokens by the requested audience. Consequently, a valid, unexpired token minted for a sensitive service (Service A) can be retrieved from the cache and sent to a secondary service (Service B). An attacker who operates, compromises, or monitors traffic to Service B can capture this token and replay it to impersonate the victim application against Service A.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-19202

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability is a caching flaw in the mcp-toolbox-sdk-python SDK's toolbox-core package. It causes the same Google ID token to be reused across different audiences within the same process. The module-level token cache fails to differentiate tokens by audience, allowing a token intended for a sensitive service to be sent to a secondary service. An attacker monitoring the secondary service can capture and replay this token to impersonate the victim application against the sensitive service.

Impact Analysis

If you use the mcp-toolbox-sdk-python SDK to authenticate to multiple services in the same process, an attacker could intercept a valid token for a sensitive service and use it to impersonate your application. This could lead to unauthorized access to sensitive data or actions, depending on the permissions of the compromised token.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements. Compliance could be impacted if the compromised tokens grant access to protected health information or personal data, potentially resulting in data breaches and regulatory penalties.

Mitigation Strategies

Update the mcp-toolbox-sdk-python SDK to a patched version that fixes the caching flaw in toolbox-core. If no patch is available, disable the module-level token cache or modify the application to avoid reusing tokens across different audiences.

Hi! I’m here to help you understand CVE-2026-19202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70