Gemini CLI v0.59.0-nightly.20260827 fixes SSRF in MCP OAuth metadata discovery and authentication
Google DeepMind
Released Aug 27, 2026 (PR #29081 by @josebalius). fix(core): prevent SSRF in MCP OAuth metadata discovery and authentication. Addresses a Server-Side Request Forgery vulnerability in the Model Context Protocol OAuth flow covering both the metadata discovery and authentication steps. Followed Aug 28 by v0.59.0-nightly.20260828.g3c311beac with no public changelog.
Why it matters
Hardens the MCP OAuth path on a security-sensitive code path that lets an attacker pivot server-side requests through the CLI; complements the v0.57.0 work from Aug 25 covered in 2026-08-27 and rounds out the MCP security uplift.
Importance: 3/5
notable release; official confirmation