{"id":"CVE-2026-93328","state":"PUBLISHED","title":"Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write","description":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.","publishedAt":"2026-10-26T14:24:09.012Z","updatedAt":"2026-10-26T16:46:45.879Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber","source":"GoogleCloud"},"assigner":"GoogleCloud","products":["Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)"],"affected":[{"vendor":"Google Cloud","product":"MCP Toolbox for Databases (googleapis/mcp-toolbox)","defaultStatus":"unaffected","versions":[{"version":"1.2.0","status":"affected","lessThan":"1.5.0","versionType":"custom"}]}],"references":["https://github.com/googleapis/mcp-toolbox/pull/3454"],"weaknesses":["CWE-862","CWE-22"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/93xxx/CVE-2026-93328.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93328","state":"PUBLISHED","datePublished":"2026-10-26T14:24:09.012Z","dateUpdated":"2026-10-26T16:46:45.879Z","assignerShortName":"GoogleCloud","assignerOrgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","dateReserved":"2026-09-17T17:27:06.678Z"},"containers":{"cna":{"title":"Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write","descriptions":[{"lang":"en","value":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters."}],"affected":[{"vendor":"Google Cloud","product":"MCP Toolbox for Databases (googleapis/mcp-toolbox)","defaultStatus":"unaffected","versions":[{"version":"1.2.0","status":"affected","lessThan":"1.5.0","versionType":"custom"}]}],"references":[{"url":"https://github.com/googleapis/mcp-toolbox/pull/3454"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing Authorization","type":"CWE"},{"cweId":"CWE-22","lang":"en","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"GoogleCloud","orgId":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","dateUpdated":"2026-10-26T14:24:09.012Z"},"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"solutions":[{"lang":"en","value":"Upgrade googleapis/mcp-toolbox to version 1.5.0 or later.\n\nConfigure the security boundaries introduced in v1.5.0 by setting allowedLocalRoots to restrict host file system interactions strictly to designated, isolated directories set allowedBuckets to ensure the tool only reads from and writes to explicit, authorized Google Cloud Storage buckets.\n\nFollow the Principle of Least Privilege by running the Toolbox service under an unprivileged OS user account and restricting associated Google Cloud IAM permissions.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade googleapis/mcp-toolbox to version 1.5.0 or later.<br><br>Configure the security boundaries introduced in v1.5.0 by setting allowedLocalRoots to restrict host file system interactions strictly to designated, isolated directories set allowedBuckets to ensure the tool only reads from and writes to explicit, authorized Google Cloud Storage buckets.<br><br>Follow the Principle of Least Privilege by running the Toolbox service under an unprivileged OS user account and restricting associated Google Cloud IAM permissions."}]}],"credits":[{"lang":"en","value":"He Wei (gikaku)","type":"reporter"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93328","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-26T15:33:21.057931Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-26T16:46:45.879Z"}}]}}}