CVE-2026-11624

CriticalCVSS 9.4/10Last modified Jul 23, 2026

Description

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "*", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "*", the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-346

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Google	MCP Toolbox for Databases	< 0.25.0

References

Timeline

Published: Jun 13, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1162406.5In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path w CVE-2026-1162418.8pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are CVE-2026-1162429.6pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded th CVE-2026-1162438.8pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary pat CVE-2026-1162449.6When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, s CVE-2026-1162459.6libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a pas CVE-2026-1162467.6To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's CVE-2026-1162479.6When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAd CVE-2026-1162486.8In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to t CVE-2026-1162499.6In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's st CVE-2026-116257.5Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before for CVE-2026-1162506.5In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened