Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/googleapis/genai-toolbox

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4GoAmendedPublished

    MCP Toolbox for Databases has an Origin Validation Error

    CVE-2026-11624 · GHSA-76g7-m3xw-x9gr

    Affected
    • Go github.com/googleapis/genai-toolbox < 0.25.0
    Fixed in
    0.25.0· Vendor fix available
    Issue
    The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "", the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.

    Recommended action: Upgrade to 0.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →