This vulnerability involves missing authorization checks in older protocol handlers of MCP Toolbox for Databases. While the newest protocol version enforces per-tool scope restrictions, older supported versions omit this enforcement. An authenticated client with limited privileges can bypass intended scope restrictions by using an older protocol version in the MCP-Protocol-Version header or by not specifying the header, which defaults to a vulnerable handler. This allows execution of high-privilege tools without proper authorization.

An attacker with authenticated access and low-privilege tokens can escalate privileges by bypassing scope restrictions, potentially executing administrative or other high-privilege tools. This could lead to unauthorized actions within the MCP Toolbox for Databases environment. There are no known exploits in the wild at this time.

No official patch or remediation is currently documented. Users should explicitly specify the protocol version header to use the 2025-11-25 handler that enforces scope restrictions. Monitor vendor advisories for updates or patches addressing this issue. Avoid relying on default protocol version handling until a fix is provided.