DNA News

Act on this, mostly signal

SSRF flaws found in several MCP projects at Google and JPMorgan

What to do

Restrict MCP server network access and check agent authorization, then patch Google MCP Toolbox CVE-2026-14540.

Why

Researcher disclosures cite a CVSS 8.0 flaw, and the Toolbox fix is already released.

Read the source at ithome.com.tw

What the research found

Researcher Syed Anas Mohiuddin disclosed SSRF flaws in MCP projects at Google, JPMorgan and others; Google's MCP Toolbox for Databases (CVE-2026-14540, CVSS 8.0) is patched, and teams should restrict MCP network access and check agent authorization.

Claims and how well the evidence supports them

  1. Google MCP Toolbox for Databases has SSRF vulnerability CVE-2026-14540 with CVSS 8.0 99%
  2. Google has patched the MCP Toolbox SSRF issue 98%

Evidence

Actionability rated high.