SSRF via Unrestricted Redirect Handling in Google mcp-toolbox HTTP Source
First seen Jul 31, 2026 · Updated Jul 31, 2026
Google's mcp-toolbox contains an SSRF vulnerability in its generic HTTP tool/source component: the underlying HTTP client follows redirects without validating destination IPs or hosts, allowing crafted path parameters to redirect requests to internal or arbitrary external endpoints. This is especially dangerous in MCP deployments because a malicious or data-driven prompt could supply the crafting input, letting an LLM-invoked tool call pivot into internal network reconnaissance or cloud metadata access.
Technical Analysis
The vulnerability resides in internal/sources/http/http.go, where the HTTP client used for generic HTTP-based MCP tools is initialized without a CheckRedirect policy and without target IP/hostname allowlisting. An attacker (or an untrusted document/prompt that influences tool parameters) can supply a path or parameter value that causes the initial request to receive a redirect response pointing to an internal address (e.g., cloud metadata service, internal admin panel) or an attacker-controlled external endpoint. Because the toolbox blindly follows redirects, the LLM agent's tool-calling layer becomes a confused deputy, issuing requests on behalf of the attacker with the toolbox's network position and credentials. This crosses the boundary between the AI agent's intended data-source access and the backend infrastructure, potentially exposing internal services, cloud IAM credentials, or enabling further lateral movement.
Affected Systems
Google mcp-toolbox; protocols: MCP
Detection Signatures
- Outbound HTTP requests from mcp-toolbox to internal/private IP ranges (169.254.169.254, 10.x, 172.16-31.x, 192.168.x) following an initial external request
- Unexpected 3xx redirect chains in mcp-toolbox HTTP source logs
- Tool parameter values containing URL-encoded internal hostnames or IP literals
- Anomalous access to cloud metadata endpoints correlated with mcp-toolbox process
- Repeated redirect-following behavior without corresponding CheckRedirect denial logs
Remediation Steps
- 1
Upgrade mcp-toolbox
Update to a patched version of Google mcp-toolbox once released (beyond 1.4.0) that implements a restrictive CheckRedirect policy and destination validation.
- 2
Implement redirect policy
Configure the HTTP client with a CheckRedirect function that blocks redirects to private/internal IP ranges, link-local addresses, and cloud metadata endpoints.
- 3
Network egress controls
Apply network-level egress filtering/firewall rules so the mcp-toolbox host cannot reach internal management interfaces or the cloud metadata service (169.254.169.254) regardless of application-layer bugs.
- 4
Input validation on tool parameters
Validate and sanitize any user- or prompt-supplied URL/path parameters before constructing outbound HTTP requests, resolving DNS to check for internal IP resolution (DNS rebinding defense).
- 5
Least privilege for toolbox credentials
Ensure the mcp-toolbox service account/IAM role has minimal permissions so that SSRF-derived credential theft has limited blast radius.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.