Am I affected by MCP Toolbox for Databases has an Origin Validation Error? What should I do?
The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks.
Affected: go/github.com/googleapis/mcp-toolbox < 0.25.0. Fixed in: 0.25.0. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-11624-mcp-toolbox-for-databases (opens external site)
1 answer
Am I affected? Affected: go/github.com/googleapis/mcp-toolbox < 0.25.0. Fixed in: 0.25.0.
- Check your version: run
go list -m github.com/googleapis/mcp-toolbox. Versions < 0.25.0 of github.com/googleapis/mcp-toolbox are affected.
What to do now
- Upgrade to the fixed version: run
go get github.com/googleapis/mcp-toolbox@v0.25.0(first patched version 0.25.0). - Specify permitted hosts at server startup using the "--allowed-hosts" flag.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-76g7-m3xw-x9gr (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-11624-mcp-toolbox-for-databases (opens external site)
Did this work for you?- Check your version: run