CVE-2026-14538: BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATIONSCHEMA, and access downstream federated row data via EXTERNALQUERY connections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14538?
CVE-2026-14538 has a medium severity rating of 5.7 based on the CVSS score.
What software is affected by CVE-2026-14538?
CVE-2026-14538 affects Google mcp-toolbox versions 0.16.1 through 1.4.0, specifically the bigquery-execute-sql tool component.
How do I fix CVE-2026-14538?
To fix CVE-2026-14538, update Google mcp-toolbox to a version that is not vulnerable to this vulnerability.
What type of vulnerability is CVE-2026-14538?
CVE-2026-14538 is an improper authorization and security-boundary bypass vulnerability.
What can attackers do with CVE-2026-14538?
Authenticated attackers can use CVE-2026-14538 to bypass allowed datasets validation checks in the bigquery-execute-sql tool.