This vulnerability in Google MCP Toolbox for Databases involves an overly permissive cross-domain policy due to a hardcoded 'Access-Control-Allow-Origin: *' header in the SSE initialization handler. Although 'allowed-origins' and 'allowed-hosts' flags were implemented during beta to comply with MCP security guidelines, the wildcard origin header was inadvertently retained. This misconfiguration allows DNS rebinding attacks when using SSE under specification v2024-11-05, potentially enabling attackers to bypass same-origin policies and interact with the service from untrusted domains. The CVSS 4.0 score of 9.4 reflects the critical nature of this issue, with network attack vector, low attack complexity, no privileges required, and high impacts on confidentiality, integrity, availability, and security requirements.

The vulnerability allows attackers to perform DNS rebinding attacks by exploiting the permissive cross-domain policy, potentially leading to unauthorized access or manipulation of data via SSE connections in the MCP Toolbox for Databases. This can compromise confidentiality, integrity, and availability of the affected service. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided, users should monitor for updates from Google. Until a patch is available, avoid using SSE connections under specification v2024-11-05 with MCP Toolbox or implement network-level controls to restrict untrusted domains if possible.