CVE-2026-14540 | Google mcp-toolbox up to 1.4.0 HTTP Client http.go server-side request forgery

A vulnerability labeled as critical has been found in Google mcp-toolbox up to 1.4.0. This issue affects some unknown processing of the file internal/sources/http/http.go of the component HTTP Client. Executing a manipulation can lead to server-side request forgery.

This vulnerability is tracked as CVE-2026-14540. The attack can be launched remotely. No exploit exists.