CVE-2026-0257 flaw in MCP Toolbox allows site based session hijack

A critical vulnerability (CVE-2026-0257) has been identified in the MCP Toolbox, affecting its integration with enterprise database connectors. This flaw allows malicious websites to bypass security controls, exposing networks to session hijacking risks. The underlying issue stems from a hardcoded access control header that overrides CORS policies, enabling unauthorized access to local servers. The recommended fix involves removing the problematic header to restore secure origin permissions, thereby protecting sensitive infrastructure.