CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481

A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability affects the cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox . The tool accepts an unvalidated pageURL parameter and issues an HTTP GET request via an authenticated client whose transport automatically a...