{"action":"Upgrade github.com/googleapis/mcp-toolbox to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"0"}],"component":"github.com/googleapis/mcp-toolbox","cve_ids":["CVE-2026-9739"],"ecosystem":"Go","epss":0.00279,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-7pf3-8xx7-rvhf","id":"tcs_01M5KF2E6M80XTDF7R9WWGWZ69","modified_at":"2026-07-07T16:11:35.449476804Z","published_at":"2026-05-28T00:30:29Z","references":["https://osv.dev/vulnerability/GHSA-7pf3-8xx7-rvhf","https://nvd.nist.gov/vuln/detail/CVE-2026-9739","https://github.com/googleapis/mcp-toolbox/issues/3053","https://github.com/googleapis/mcp-toolbox/pull/3054","https://github.com/googleapis/mcp-toolbox/commit/c4c7bd917e686de68e2be866cfe3872c3439efae","https://github.com/googleapis/mcp-toolbox"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-7pf3-8xx7-rvhf","url":"https://osv.dev/vulnerability/GHSA-7pf3-8xx7-rvhf"}],"summary":"MCP Toolbox for Databases vulnerable to DNS rebinding attacks"}