CVE-2026-14538: BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATIONSCHEMA, and access downstream federated row data via EXTERNALQUERY connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until the bigquery-execute-sql authorization boundary bypass is remediated, restrict network/API access so authenticated attackers cannot use the MCP toolbox to execute arbitrary BigQuery queries (e.g., limit the service’s ability to call BigQuery INFORMATION_SCHEMA and federated EXTERNAL_QUERY to only required datasets/connections).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14538?
CVE-2026-14538 has a medium severity rating of 5.7 based on the CVSS score.
What software is affected by CVE-2026-14538?
CVE-2026-14538 affects Google mcp-toolbox versions 0.16.1 through 1.4.0, specifically the bigquery-execute-sql tool component.
How do I fix CVE-2026-14538?
To fix CVE-2026-14538, update Google mcp-toolbox to a version that is not vulnerable to this vulnerability.
What type of vulnerability is CVE-2026-14538?
CVE-2026-14538 is an improper authorization and security-boundary bypass vulnerability.
What can attackers do with CVE-2026-14538?
Authenticated attackers can use CVE-2026-14538 to bypass allowed datasets validation checks in the bigquery-execute-sql tool.