CVE-2026-11717

An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes the response into an introspectResp struct where the Active field is declared as a pointer to a boolean (*bool). The code only explicitly rejects a token if the response contains a populated active field set to false (if introspectResp.Active != nil && !*introspectResp.Active). If an introspection endpoint responds with a payload that completely omits the mandatory active key, the internal variable remains nil, causing the conditional check to short-circuit. As a result, Toolbox accepts authorization tokens missing the "active" field, granting access to protected tools and underlying data sources.

• CWE-287

• https://github.com/googleapis/mcp-toolbox/pull/3341Patch, Third Party Advisory

Published

Jun 18, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1171A flaw has been found in birkir prime up to 0.4.0.beta.0. Im…7.5
• CVE-2026-11710IBM WebSphere Application Server 8.5 is affected by an HTTP …6.5
• CVE-2026-11711IBM WebSphere Application Server 9.0 and 8.5 is affected by …6.5
• CVE-2026-11712IBM WebSphere Application Server 9.0, and 8.5 is affected by…9.3
• CVE-2026-11714IBM WebSphere Application Server Liberty is affected by a se…9.8
• CVE-2026-11716IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an…7.5
• CVE-2026-11718An authentication bypass vulnerability exists in the generic…9.1
• CVE-2026-11719An authenticated authorization bypass vulnerability exists i…8.1
• CVE-2026-1172A vulnerability has been found in birkir prime up to 0.4.0.b…7.5
• CVE-2026-11720A path traversal vulnerability exists in the HTTP tool URL b…9.1
• CVE-2026-11721It is possible for an attacker's zone to respond to a query …7.5
• CVE-2026-11722IBM WebSphere Application Server and WebSphere Application S…4.8