FAIL › dossier
mcp toolbox for databases
PRODUCT· dossier confidence 20%
ArcadeDB joined Google's MCP Toolbox for Databases, enabling MCP-compatible agents to query multi-model data with built-in observability. However, the MCP Toolbox integration has critical vulnerabilities including path traversal, incorrect authorization, and authentication bypasses that require immediate remediation.
PROFILE
CategorydatabaseWhat they doArcadeDB is a multi-model database supporting graph, document, vector, and time-series data with Cypher and SQL query capabilities.
Websitehttps://arcadedb.com ↗
SECURITY POSTURE
The MCP Toolbox integration exhibits critical vulnerabilities including path traversal, incorrect authorization, and authentication bypasses in its HTTP tool URL builder and API endpoints.
Notable failures
- CVE-2026-11720 path traversal in HTTP tool URL builder
- CVE-2026-14537 incorrect authorization in direct HTTP API tool invocation
- CVE-2026-11718 authentication bypass in generic opaque token validation
Patterns: critical vulnerabilities in HTTP tool URL builder and API endpoints; authentication bypasses in generic opaque token validation
FAILURE HISTORY · 4
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-07-31 | CVE-2026-14537 | critical | An unauthenticated attacker can invoke protected tools via legacy HTTP endpoints in Google's mcp-toolbox v1.3.0 and v1.4.0 when the --enable-api flag is active. |
| 2026-06-29 | CVE-2026-11720 | critical | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While |
| 2026-06-18 | CVE-2026-11718 | critical | CVE-2026-11718: An authentication bypass vulnerability exists in the generic opaque token valida |
| 2026-06-18 | CVE-2026-11717 | critical | CVE-2026-11717: An authentication bypass vulnerability exists in the generic opaque token valida |
DOSSIER SOURCES
- ArcadeDB Joins Google's MCP Toolbox for Databases · arcadedb.com
- About MCP servers in Knowledge Catalog | Google Cloud Documentation · docs.cloud.google.com
- MCP tools | CX Agent Studio | Google Cloud Documentation · docs.cloud.google.com
Open questions: Is MCP Toolbox for Databases a standalone product or part of a larger Google Cloud offering? · What is the current patch status for CVE-2026-11720, CVE-2026-14537, CVE-2026-11718, and CVE-2026-11717?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-20 04:25:13.822302+00:00