The vulnerability in googleapis/mcp-toolbox (version 0.19.1) involves the cloud-healthcare-fhir-fetch-page tool accepting an unvalidated pageURL parameter from clients. When the tool issues an HTTP GET request to this URL, it automatically includes an Authorization: Bearer header containing OAuth or service-account tokens. An attacker can exploit this by supplying a malicious external URL, causing the tool to send sensitive tokens to an attacker-controlled endpoint. This SSRF vulnerability can lead to credential exfiltration and exposure of PHI and other cloud resources. The affected product is a cloud-hosted service, and the vendor manages remediation server-side. A patch is available, but specific patch details are not provided in the advisory.

Successful exploitation allows an attacker to obtain OAuth or service-account access tokens by tricking the tool into sending authenticated requests to attacker-controlled URLs. This can lead to unauthorized access to Protected Health Information (PHI) and other Google Cloud Platform services, posing a significant confidentiality risk. The CVSS 4.0 score of 8.4 (high severity) reflects the network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and system integrity.

Since this is a cloud-hosted service, Google manages remediation server-side. A patch is available for the vulnerability. Users should monitor the vendor advisory for deployment status and ensure they are using updated versions or configurations as recommended by Google. No additional user action is specified in the advisory.