--- title: Google, JPMorgan and two governments fixed the same MCP flaw description: Independent researcher Syed Anas Mohiuddin found the same server-side request forgery flaw in MCP servers run by Google, JPMorgan Chase, Weaviate, France's... canonical: https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Google, JPMorgan and two governments fixed the same MCP flaw | daily.dev og:description: Independent researcher Syed Anas Mohiuddin found the same server-side request forgery flaw in MCP servers run by Google, JPMorgan Chase, Weaviate, France's... og:url: https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp og:image: https://api.daily.dev/og/posts/oSlgZ0TLp.png og:image:alt: Google, JPMorgan and two governments fixed the same MCP flaw og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Google, JPMorgan and two governments fixed the same MCP flaw **[The Next Web](https://daily.dev/sources/tnw)** · 4 min read · 0 upvotes · 0 comments ## Summary Independent researcher Syed Anas Mohiuddin found the same server-side request forgery flaw in MCP servers run by Google, JPMorgan Chase, Weaviate, France's DINUM, and Tangerang city government, confirming his earlier prediction that the bug class was structural rather than a one-off coding mistake. Each server built outbound requests from caller-supplied URLs without validating where they actually resolved, letting an attacker reach internal or cloud metadata endpoints. Google's MCP Toolbox for Databases flaw (CVE-2026-14540) rates 8.0 severity; fixes have shipped for Google, JPMorgan, Weaviate, DINUM, and Tangerang's Wazuh server, while five US GSA servers (including Veterans Affairs benefits claims and CDC PLACES) and a Japan Digital Agency grants server remain unpatched. Mohiuddin terms the broader attack class 'protocol pivoting,' where injected text disguised as an A2A task gets executed by a trusting subagent, and will present findings at MCPCon North America on October 23. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-14540 in Google's MCP Toolbox for Databases? CVE-2026-14540 is a high-severity (8.0) server-side request forgery flaw in Google's MCP Toolbox for Databases, affecting versions 0.3.0 to 1.4.0. The HTTP client had no restrictive redirect policy and no check on target IP addresses, so a crafted path parameter could send requests to internal or external endpoints. Google's fix adds DNS rebinding protection and allowed/blocked IP range lists. _Teams running MCP Toolbox for Databases can track patch details like this through daily.dev._ ### What is protocol pivoting in AI agent security? Protocol pivoting is an attack class where text planted in content an MCP tool returns is shaped to look like a task for the A2A protocol; an orchestrating agent passes it to a subagent, which executes it because it trusts the orchestrator. Rapid7's Douglas McKee notes every component behaves as designed, making the chain hard to detect, and X41 D-Sec's Markus Vervier describes it as a form of indirect prompt injection. _Developers securing multi-agent pipelines can follow emerging attack patterns like this on daily.dev._ ### Which MCP servers still have unpatched SSRF or authentication flaws? Five servers under the US General Services Administration's Technology Transformation Services remain in triage as of early September, covering Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending, and CDC PLACES; the Veterans Affairs server logs full unredacted API error responses that can include a veteran's SSN, name, date of birth, and address. Japan's Digital Agency grants server, which had no authentication, also remains open. _Anyone auditing government or enterprise MCP deployments can track disclosure status via daily.dev._ ## Similar posts on daily.dev - [Bug hunter tracks down three massive MCP flaws and one vendor won't fix theirs](https://daily.dev/posts/bug-hunter-tracks-down-three-massive-mcp-flaws-and-one-vendor-won-t-fix-theirs-grn4hyt1t) · The Register · 1 upvotes · 0 comments - [MCP Horror Stories: WhatsApp Data Exfiltration](https://daily.dev/posts/mcp-horror-stories-whatsapp-data-exfiltration-r4vska2bl) · Docker · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Google, JPMorgan and two governments fixed the same MCP flaw","url":"https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp"},"datePublished":"2026-10-06T00:33:53.431Z","dateModified":"2026-10-06T00:49:36.602Z","description":"Independent researcher Syed Anas Mohiuddin found the same server-side request forgery flaw in MCP servers run by Google, JPMorgan Chase, Weaviate, France's...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12c50b024652795cf8acca35ededaf34?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12c50b024652795cf8acca35ededaf34?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,mcp,prompt-injection","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Google, JPMorgan and two governments fixed the same MCP flaw"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/google-jpmorgan-and-two-governments-fixed-the-same-mcp-flaw-oslgz0tlp#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-14540 in Google's MCP Toolbox for Databases?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-14540 is a high-severity (8.0) server-side request forgery flaw in Google's MCP Toolbox for Databases, affecting versions 0.3.0 to 1.4.0. The HTTP client had no restrictive redirect policy and no check on target IP addresses, so a crafted path parameter could send requests to internal or external endpoints. Google's fix adds DNS rebinding protection and allowed/blocked IP range lists. Teams running MCP Toolbox for Databases can track patch details like this through daily.dev."}},{"@type":"Question","name":"What is protocol pivoting in AI agent security?","acceptedAnswer":{"@type":"Answer","text":"Protocol pivoting is an attack class where text planted in content an MCP tool returns is shaped to look like a task for the A2A protocol; an orchestrating agent passes it to a subagent, which executes it because it trusts the orchestrator. Rapid7's Douglas McKee notes every component behaves as designed, making the chain hard to detect, and X41 D-Sec's Markus Vervier describes it as a form of indirect prompt injection. Developers securing multi-agent pipelines can follow emerging attack patterns like this on daily.dev."}},{"@type":"Question","name":"Which MCP servers still have unpatched SSRF or authentication flaws?","acceptedAnswer":{"@type":"Answer","text":"Five servers under the US General Services Administration's Technology Transformation Services remain in triage as of early September, covering Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending, and CDC PLACES; the Veterans Affairs server logs full unredacted API error responses that can include a veteran's SSN, name, date of birth, and address. Japan's Digital Agency grants server, which had no authentication, also remains open. Anyone auditing government or enterprise MCP deployments can track disclosure status via daily.dev."}}]} ```