CVE-2026-11718 is a critical authentication bypass (CVSS 9.1) in googleapis/mcp-toolbox. If an introspection response leaves out the optional iss issuer field, the issuer check is skipped silently, so tokens from unintended identity providers are accepted. The fix is pull request 3360, released in v1.4.0.
What's affected
From the CVE record, the pull request and the release notes:
- Product: googleapis/mcp-toolbox (Google MCP Toolbox for Databases), generic OAuth with opaque token validation.
- Components:
validateOpaqueTokenandvalidateClaims. - Cause: the issuer test is written as
a.issuer != "" && iss != "". If the provider's response has noiss, the variable is empty and the whole check is skipped. - Fixed in: pull request 3360, "enforce issuer presence in opaque token validation", merged 4 June 2026 and listed in the v1.4.0 release notes.
- Affected versions: the record gives no range. Treat releases before v1.4.0 as in scope.
- Weakness class: CWE-287 (improper authentication).
- Severity: CVSS 9.1, network reachable with no privileges and no user interaction.
- Related: CVE-2026-11717 is a separate flaw in the same code path and is fixed in the same release.
How to check if you're exposed
- Find all deployments of the toolbox and read their versions. Releases before v1.4.0 need the upgrade.
toolbox --version
- Check whether your configuration uses a generic OAuth provider with an introspection endpoint, and whether you set an expected issuer for it. The flaw affects deployments that expect an issuer.
- Check what your identity provider returns. Some providers include
issin introspection responses and some do not. If yours does not, it is the case the flaw describes. - Ask whether more than one identity provider is trusted in your organization. The impact grows when other providers could issue tokens that would pass.
What to do now
- Upgrade to v1.4.0 or later.
- Review which identity provider you trust and make sure the expected issuer is set in the toolbox configuration.
- Give the toolbox only the database access its tools need, and use read only credentials for read only tools.
- Restrict network access to the toolbox to the clients that need it.
- Check logs from before the upgrade for tool calls tied to tokens from an unexpected provider.
Why it matters
An issuer check answers a simple question: did the identity provider I trust issue this token? If the check can be skipped, the toolbox stops asking that question. Per the record, tokens issued by "unauthorized or unintended third-party identity providers" can then be accepted.
The bug is a guard that only runs when both sides are non-empty. The configured issuer was set, but the response value was empty, and the combined condition turned false so the check never ran. A missing claim should have been a failure. When you write or review validation code, look for conditions that treat an absent value as "nothing to compare" instead of "reject".
The pull request enforces that the issuer is present in the introspection response when one is expected. The CVSS vector gives High impact on confidentiality and integrity, since an accepted token reaches the tools and data sources behind the toolbox. It is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is this the same bug as CVE-2026-11717?
No. CVE-2026-11717 is a missing active field. This one is a missing iss field. Both are in the generic opaque token path and both are fixed in v1.4.0.
Do I need to change my identity provider?
No. Upgrade the toolbox. Setting an expected issuer in the configuration is still good practice.
Sources
- Gold entry and CVE record: CVE-2026-11718.
- Pull request 3360 in googleapis/mcp-toolbox, merged 4 June 2026.
- mcp-toolbox v1.4.0 release notes, published 4 June 2026.
Last reviewed: 19 October 2026.
