Threats tagged 'ghsa-f8h2-c55w-8m5p'

Google mcp-toolbox versions v1.3.0 and v1.4.0 contain an incorrect authorization vulnerability in the direct HTTP API tool invocation endpoint. This flaw allows an unauthenticated attacker to invoke tools that should be protected by the scopeRequired feature by sending requests through legacy HTTP endpoints when the --enable-api flag is enabled. The vulnerability has a high severity with a CVSS score of 9.8, indicating critical impact on confidentiality, integrity, and availability.