The vulnerability exists in the URL builder component of googleapis/mcp-toolbox, which constructs downstream API requests by substituting user-controlled path parameters into a configured tool path. Although the input is checked to prevent changes to the scheme, host, or user info, the final URL resolution uses ResolveReference, which normalizes dot segments such as '../'. This normalization allows an attacker to supply directory traversal sequences that escape the operator-configured path scope. Consequently, the toolbox can be tricked into making requests to unintended endpoints on the same target host, forwarding its configured credentials and potentially bypassing path restrictions.

An attacker can exploit this vulnerability to perform unauthorized requests to restricted endpoints on the same host by escaping the intended path scope. This could lead to unauthorized access to sensitive resources or administrative endpoints, leveraging the toolbox's credentials. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been provided at this time. Until a patch is available, users should consider restricting or validating path parameters more strictly to prevent directory traversal sequences or avoid using untrusted input in path construction.