CVE-2026-97228 and googleapis/mcp-toolbox disclose SSRF via MCP trust gaps

MCP servers store per-agent credentials and forward tasks without re-authenticating origin. Mohiuddin’s PoCs injected instructions into one agent that were accepted by downstream agents because MCP and A2A lack cross-protocol authorization checks. Google’s mcp-toolbox HTTP client omitted CheckRedirect and IP allow-lists, permitting crafted paths to reach internal endpoints.

Rapid7’s network agent accepted delegated tasks from any internal MCP peer and executed them against its own credential store. The 2.7 CVSS score reflected limited blast radius once the initial foothold existed; the 8.0 Google score reflected direct internal network reach. Both fixes added static allow-lists at startup rather than per-request validation.

MCP, A2A, and emerging Agent Network Protocol were each specified under the assumption of a single trusted domain. No specification defines a canonical way to carry provenance or revocation across protocol boundaries. The result is a hallway problem: each component inspects only its immediate caller.

Organizations running more than three MCP-speaking agents should enforce outbound allow-lists at every MCP server and require signed task tokens that survive protocol translation. Without these controls, additional CVEs in the same class are expected within twelve months.