What is CVE-2026-16481?
A critical Server-Side Request Forgery (SSRF) vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox, allowing authenticated attackers to exfiltrate credentials via arbitrary HTTP GET requests. This occurs because the tool fails to validate the user-supplied pageURL parameter before issuing authenticated requests, posing a risk of unauthorized access to internal services. Mitigation requires strict input validation on the affected parameter.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
Does exploiting CVE-2026-16481 require the attacker to be authenticated?
Yes, the vulnerability allows an authenticated attacker to send arbitrary HTTP GET requests.
What mitigation is recommended for CVE-2026-16481?
Strict input validation on the `pageURL` parameter should be implemented.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.