Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-93328

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GoogleCloud

Description

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)

Default version status: unaffected

  • 1.2.0 to < 1.5.0affected

References