Vulnerable to DNS rebinding attacks when using SSE

CVE-2026-9739 is a DNS rebinding / CORS policy bypass in Google MCP Toolbox for Databases when the server is used over HTTP+SSE under MCP spec v2024-11-05. The SSE initialization handler kept a hardcoded Access-Control-Allow-Origin: *, which neutered the product's own --allowed-origins protection and let a malicious website talk to a victim's Toolbox instance through the browser. The fix landed in v1.2.0; based on release history, the vulnerable window is at least pre-1.2.0 builds using SSE, with beta-era builds likely included.

The scary part is what the Toolbox can reach: databases, cloud data sources, and whatever tools the operator wired into it. But the vendor-style CRITICAL/9.4 framing overstates enterprise reality because exploitation is not a clean unauthenticated internet service hit. It requires a victim running Toolbox over SSE, a browser session, a malicious page, and a reachable local or internal HTTP endpoint. That's a meaningful chain of prerequisites, so this belongs in MEDIUM, not in your top emergency patch lane.

Why this verdict

• Browser-required chain: exploitation needs a victim to visit attacker content while Toolbox is running and reachable from the browser; that is materially narrower than a raw unauthenticated network bug.
• Transport-specific exposure: this only hits the SSE/HTTP path under MCP spec v2024-11-05; --stdio users and non-SSE flows are outside the blast radius.
• Population limiter: MCP Toolbox is not a universal enterprise agent. Even among adopters, only a subset expose remote HTTP listeners with sensitive backends attached, so the vulnerable population is much smaller than the vendor-style score implies.

Why not higher?

I am not calling this HIGH or CRITICAL because the attacker does not simply point a socket at an exposed daemon and win. They need user interaction, a compatible browser path, a running vulnerable instance, and the right transport mode. Those are compounding friction points that sharply reduce exploit scale in real fleets.

Why not lower?

I am not dropping it to LOW because when the chain works, the attacker can pivot through a trusted MCP bridge into real data systems. On developer endpoints or analyst jump boxes with broad DB access, the confidentiality impact can be substantial even if the exploit path is finicky.

1. Prefer --stdio where possible — Move local IDE and agent workflows off remote HTTP/SSE and onto stdio where the protocol design allows it. That removes the browser-reachable attack surface entirely; for a MEDIUM finding there is no mitigation SLA, so do this during normal architecture hardening rather than as an emergency change.
2. Lock down --allowed-hosts and --allowed-origins — Set explicit hostnames and frontend origins instead of *, and verify they survive startup wrappers, containers, and service definitions. Even though this bug bypassed origin checks on the vulnerable SSE path, strict host validation still cuts off common rebinding routes; there is no mitigation SLA, so apply in the next normal change window.
3. Keep Toolbox on loopback unless there is a real reason not to — The CLI default listen address is 127.0.0.1; keep it there for workstation use and avoid 0.0.0.0 unless you intentionally need shared access. That sharply shrinks the exposed population; for MEDIUM, treat this as routine hardening with no mitigation SLA.
4. Reduce backend privileges behind Toolbox — The real damage comes from what the configured tools can reach, so use read-only DB identities where practical and split privileged write paths away from developer-facing MCP servers. This limits blast radius even if the browser pivot succeeds; again, no mitigation SLA applies.

Run this on the target host or developer workstation where toolbox is installed. Invoke it as python3 check_cve_2026_9739.py --binary /usr/local/bin/toolbox --config /path/to/tools.yaml; no admin rights are required unless your config files are unreadable to the current user. It checks the local Toolbox version and, if you provide config files, looks for obvious SSE transport markers before returning VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2026_9739.py
# Detect likely exposure to CVE-2026-9739 in Google MCP Toolbox for Databases.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import os
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

PATCHED_VERSION = (1, 2, 0)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)')
SSE_PATTERNS = [
    re.compile(r'\bsse\b', re.IGNORECASE),
    re.compile(r'/mcp\b', re.IGNORECASE),
    re.compile(r'event-stream', re.IGNORECASE),
]


def parse_version(text: str) -> Optional[Tuple[int, int, int]]:
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v: Tuple[int, int, int]) -> str:
    return '.'.join(str(x) for x in v)


def run_version(binary: str) -> Tuple[Optional[Tuple[int, int, int]], str]:
    cmds = [
        [binary, '--version'],
        [binary, '-v'],
        [binary, 'version'],
    ]
    output = ''
    for cmd in cmds:
        try:
            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            output = (proc.stdout or '') + '\n' + (proc.stderr or '')
            v = parse_version(output)
            if v:
                return v, output.strip()
        except Exception:
            continue
    return None, output.strip()


def file_contains_sse(path: str) -> Optional[bool]:
    try:
        with open(path, 'r', encoding='utf-8', errors='ignore') as fh:
            data = fh.read()
    except Exception:
        return None

    for pat in SSE_PATTERNS:
        if pat.search(data):
            return True
    return False


def main() -> int:
    parser = argparse.ArgumentParser(description='Check likely exposure to CVE-2026-9739')
    parser.add_argument('--binary', default='toolbox', help='Path to toolbox binary (default: toolbox in PATH)')
    parser.add_argument('--config', action='append', default=[], help='Optional config file(s) to inspect for SSE usage')
    args = parser.parse_args()

    binary = args.binary
    if os.path.sep not in binary:
        resolved = shutil.which(binary)
        if resolved:
            binary = resolved

    if not os.path.exists(binary):
        print('UNKNOWN - toolbox binary not found: {}'.format(args.binary))
        return 2

    version, raw = run_version(binary)
    if not version:
        print('UNKNOWN - unable to determine toolbox version from: {}'.format(raw or 'no output'))
        return 2

    if version >= PATCHED_VERSION:
        print('PATCHED - toolbox {} is >= {}'.format(version_str(version), version_str(PATCHED_VERSION)))
        return 0

    # Pre-1.2.0 is potentially affected, but the CVE is specific to SSE transport.
    if not args.config:
        print('UNKNOWN - toolbox {} is < {}, but SSE usage was not checked (supply --config)'.format(
            version_str(version), version_str(PATCHED_VERSION)
        ))
        return 2

    saw_readable = False
    sse_hit = False
    unreadable = []
    clean = []

    for cfg in args.config:
        result = file_contains_sse(cfg)
        if result is None:
            unreadable.append(cfg)
            continue
        saw_readable = True
        if result:
            sse_hit = True
        else:
            clean.append(cfg)

    if sse_hit:
        print('VULNERABLE - toolbox {} is < {} and at least one config appears to reference SSE'.format(
            version_str(version), version_str(PATCHED_VERSION)
        ))
        return 1

    if saw_readable:
        print('UNKNOWN - toolbox {} is < {}, but provided config(s) did not show obvious SSE markers'.format(
            version_str(version), version_str(PATCHED_VERSION)
        ))
        return 2

    print('UNKNOWN - toolbox {} is < {}, but config files were unreadable: {}'.format(
        version_str(version), version_str(PATCHED_VERSION), ', '.join(unreadable) if unreadable else 'none'
    ))
    return 2


if __name__ == '__main__':
    sys.exit(main())

Sources

1. NVD CVE-2026-9739
2. GitHub Advisory GHSA-7pf3-8xx7-rvhf
3. Security issue #3053
4. Fix PR #3054
5. MCP Toolbox release notes
6. MCP Toolbox changelog
7. MCP Toolbox CLI hardening docs
8. Censys MCP exposure research