Google MCP Toolbox for Databases

• CVE-2026-102242 High 8.6 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases 0.4%
• CVE-2026-11624 Critical 9.4 The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had 0.2%
• CVE-2026-9739 Critical 9.4 Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. Howeve 0.3%