CVE-2026-11720

🗓️ 29 Jun 2026 17:51:30Reported by GoogleType

cve🔗 web.nvd.nist.gov👁 81 Views🌐 WEB

Path traversal in the web tool URL builder lets path parameters escape the configured path via dot segments.

Reporter	Title	Published	Views	Family All 31
attackerkb	CVE-2026-11720	29 Jun 202617:51	–	attackerkb
Circl	CVE-2026-11720	29 Jun 202618:44	–	circl
Cvelist	CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder	29 Jun 202617:51	–	cvelist
EUVD	EUVD-2026-40146	29 Jun 202617:51	–	euvd
Github Security Blog	MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints	29 Jun 202618:31	–	github
Mend	CVE-2026-11720	29 Jun 202617:51	–	mend
NVD	CVE-2026-11720	29 Jun 202618:16	–	nvd
OSV	GHSA-VWXW-JRG6-9JXV MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints	29 Jun 202618:31	–	osv
OSV	GO-2026-6411 MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox	10 Sep 202614:48	–	osv
OSV	OPENSUSE-SU-2026:21897-1 Security update for govulncheck-vulndb	21 Sep 202612:36	–	osv

NVD

Vulners

Node

google mcp_toolbox_for_databasesRange<1.3.0

[
  {
    "vendor": "Google",
    "product": "MCP Toolbox for Databases (googleapis/mcp-toolbox)",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/googleapis/mcp-toolbox/pull/3218

Parameter	Position	Path	Description	CWE
id	path	/api/v1/users/{{.id}}	Path traversal via user-controlled path parameter in URL builder; dot segments are resolved and can escape configured path to reach unintended endpoints on the same host (e.g., /admin/secrets).	CWE-22

01 Jul 2026 19:55Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.1

CVSS 49.3

EPSS0.00533

SSVC

CWE-22