Google mcp-toolbox versions 0.3.0 through 1.4.0 contain an SSRF vulnerability in their generic HTTP source and tool components. Although baseline input sanitization is implemented, the underlying HTTP client (internal/sources/http/http.go) lacks a restrictive CheckRedirect policy and does not validate the IP addresses of redirection targets. This allows an attacker or malicious prompt to supply a crafted path parameter that triggers open redirects or destination swaps, causing the toolbox to follow redirects blindly and make unauthorized requests to internal or arbitrary external endpoints.

The vulnerability can be exploited to coerce the mcp-toolbox into making unauthorized HTTP requests to internal or external systems. This may lead to limited confidentiality and integrity impacts, such as information disclosure or unauthorized interactions with backend services. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, avoid exposing the vulnerable components to untrusted inputs or untrusted networks where possible.