Google assigned CVE-2026-14540 to an SSRF in googleapis/mcp-toolbox versions 0.3.0 through 1.4.0. CVSS v4.0 8.0 High, CWE-918. The HTTP client lacked a restrictive CheckRedirect policy and target IP validation. A crafted path parameter could make the toolbox follow a redirect to an internal endpoint.
The fix landed in PR #3448, released as v1.5.0, adding redirect and target validation plus DNS-rebinding protection at connection time.
Similar SSRF patterns were found at Anthropic (mcp-server-fetch), Microsoft (playwright-mcp), and Weaviate. The researcher generalized findings into IETF Internet-Draft draft-mohiuddin-mcp-security-considerations-00, naming the cross-protocol pattern “Protocol Pivoting”: an attacker enters through the model-facing protocol and pivots into whatever the server can reach behind it.
Other confirmed protocol-pivoting cases include JPMorgan Chase, France’s interministerial digital directorate, and Tangerang City government in Indonesia. Rapid7 published a CVE for a related bug.