CVE-2026-11720: Path Traversal in Google MCP Toolbox HTTP Tool

CVE-2026-11720 is a critical path traversal (CVSS 9.1) in the HTTP tool URL builder of googleapis/mcp-toolbox. Path parameters with dot segments can escape the path the operator configured, so the toolbox calls other endpoints on the same host with its own credentials. The fix is pull request 3218.

What's affected

From the CVE record and the pull request:

• Product: googleapis/mcp-toolbox (Google MCP Toolbox for Databases), when HTTP tools with path parameters are configured.
• Component: the HTTP tool URL builder, which substitutes user controlled pathParams into the configured tool path.
• Cause: the builder checks that the input does not change the scheme, host or user info, then relies on ResolveReference. That step normalizes dot segments, so a value can climb out of the configured path.
• Fixed in: pull request 3218, "prevent path traversal and base path scope escape", merged 12 May 2026.
• Fixed release: we could not confirm which release first contains the change. Releases cut after 12 May 2026, including v1.4.0 from 4 June 2026, should include it. Check the release notes for your version.
• Weakness class: CWE-22 (path traversal).
• Severity: CVSS 9.1, network reachable with no privileges, High impact on confidentiality and integrity.

How to check if you're exposed

The flaw matters when you define an HTTP tool whose path contains a parameter.

1. Read the toolbox version.

toolbox --version

2. Review your tool configuration for HTTP tools whose path includes a substituted parameter. Tools without path parameters are not what the record describes.
3. For each such tool, write down what else the same host serves under a parent path, and which credentials the toolbox forwards to it. The record gives the example of a restricted users path and an admin path on one host.
4. Check whether the downstream API has its own authorization on each endpoint. If it relies on the toolbox to confine calls to one path, a traversal can cross that line.

What to do now

1. Upgrade to a current release. Confirm in the release notes that pull request 3218 is included, because the record does not name a fixed version.
2. Give the credentials the toolbox forwards the least privilege possible, so that a request to an unintended path on the same host cannot do much.
3. Have the downstream API enforce its own authorization per endpoint instead of trusting the caller to stay on one path.
4. Where you can, expose only the tools you need, and restrict network access to the toolbox.
5. Check downstream API logs for requests that came from the toolbox to paths outside your configured tool paths.

Why it matters

Path traversal is the old habit of stepping out of a folder with dot segments. Here it works on a URL instead of a file system. A configured path such as a users endpoint is meant to confine every call a tool makes. If a client can supply a value that contains dot segments, and the URL resolution step collapses them, the final URL can point somewhere else on the same host.

The code in question did check for changes to the scheme, host and user info, which are the obvious ways to redirect a request. It missed that the resolution function itself normalizes the path afterwards. That is a common pattern: validate the raw input, then let a library transform it, and never validate the result. The better habit is to check the final URL against the allowed base after resolution.

The impact depends on what else the host serves and which credentials the toolbox sends. The record notes that the toolbox forwards its configured credentials, so the forged request carries them. That is why the vector shows High confidentiality and integrity impact. Narrow credentials and per endpoint authorization on the downstream API turn this from a pivot into a failed request. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.

Quick check

Sources

• Gold entry and CVE record: CVE-2026-11720.
• Pull request 3218 in googleapis/mcp-toolbox, merged 12 May 2026.

Last reviewed: 19 October 2026.