The SSRF vulnerability in Google mcp-toolbox affects versions 0.3.0 through 1.4.0. The toolbox's generic HTTP source and tool components implement baseline input sanitization but rely on an HTTP client that lacks a restrictive CheckRedirect policy and does not validate the IP addresses of redirection targets. This flaw allows an attacker or malicious prompt to supply crafted path parameters that trigger open redirects or destination swaps, causing the toolbox to follow redirects blindly and send unauthorized requests to internal or external endpoints. This can lead to unauthorized access or information disclosure within internal networks or to arbitrary external systems.

An attacker can coerce the mcp-toolbox to perform unauthorized HTTP requests to internal or arbitrary external endpoints by exploiting the lack of redirect restrictions and IP validation. This can potentially expose internal services or sensitive data accessible only from the toolbox's environment. The vulnerability is rated high severity with a CVSS score of 8. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the mcp-toolbox service and carefully validate or sanitize any user-controlled input that influences HTTP requests. Monitoring for unusual outbound requests from the toolbox environment may help detect exploitation attempts.