Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-16481

CVE-2026-16481MEDIUM

Google MCP Toolbox for Databases (googleapis/mcp-toolbox) — Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   H   N   N    6.0   .0019    8.1     —

AFFECTED
  Product                                             Versions  Fixed
  MCP Toolbox for Databases (googleapis/mcp-toolbox)  0.19.1 –  —

TIMELINE
  Jul 21  Reserved by Google
  Jul 27  Published (CNA: Google)
  Sep 10  RESCORED — CVE-2026-16481 (Google MCP Toolbox for Databases (googleapis/mcp-toolbox)). CVSS 8.4 → 6 (NVD).

CWE-918 · CNA: Google · CVSS v4.0 · 1 reference · NVD status: Analyzed

Description

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The underlying transport automatically attaches an Authorization: Bearer header to every outbound request regardless of the destination host. An attacker can supply an arbitrary external URL to the pageURL parameter (either directly via the tool execution payload or implicitly via data-driven pagination tracking loops), leading Toolbox into sending its OAuth/service-account access token to an attacker-controlled listener. Depending on the configuration, this leaks either the end-user's token or the broader service-account access token (ADC), potentially exposing Protected Health Information (PHI) and secondary Google Cloud Platform services.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 21, 2026	Reserved	Reserved by Google
July 27, 2026	Published	Published (CNA: Google)
September 10, 2026	RESCORED	RESCORED — CVE-2026-16481 (Google MCP Toolbox for Databases (googleapis/mcp-toolbox)). CVSS 8.4 → 6 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	—	0.19.1	—

Weaknesses

CWE-918

References (1)

https://github.com/googleapis/mcp-toolbox/pull/3453 [Patch, Vendor Advisory, Issue Tracking]

Authoritative record: CVE-2026-16481 at cve.org

Vendors: google

Weaknesses: CWE-918

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-16481 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.