CVE-2026-93328: Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Q: Which deployments are exposed to unauthenticated exploitation?

Google Cloud MCP Toolbox for Databases versions 1.2.0 through 1.4.0 are affected when using the cloud-storage source. The issue can be exploited remotely without authentication.

Q: What access does an attacker need to exploit the issue?

An attacker only needs the ability to send crafted tool invocation parameters to the vulnerable cloud-storage source. No authentication is required.

Q: What could an attacker do on a compromised deployment?

An attacker can exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files. Both outcomes are enabled through crafted path traversal parameters.

Published Oct 26, 2026

Updated

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

Affected Software

1 affected component

Google Mcp Toolbox For Databases>=1.2.0<=1.4.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade googleapis/mcp-toolbox to a version that resolves this vulnerability.
Fixed in 1.5.0
Configuration
Set allowedLocalRoots to restrict host filesystem interactions strictly to designated, isolated directories.
MCP Toolbox for Databases allowedLocalRoots = designated, isolated directories
Configuration
Set allowedBuckets so the tool only reads from and writes to explicit, authorized Google Cloud Storage buckets.
MCP Toolbox for Databases allowedBuckets = explicitly authorized Google Cloud Storage buckets
Configuration
Run the Toolbox service under an unprivileged OS user account.
Toolbox service OS service account = unprivileged OS user account
Configuration
Restrict the associated Google Cloud IAM permissions according to the Principle of Least Privilege.
Google Cloud IAM associated permissions = restricted permissions following the Principle of Least Privilege

Event History

Oct 26, 2026

CVE Published

via MITRE·02:24 PM

Data Sourced

via MITRE·02:24 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Google Cloud MCP Toolbox for Databases versions 1.2.0 through 1.4.0 are affected when using the cloud-storage source. The issue can be exploited remotely without authentication.

What access does an attacker need to exploit the issue?

An attacker only needs the ability to send crafted tool invocation parameters to the vulnerable cloud-storage source. No authentication is required.

What could an attacker do on a compromised deployment?

An attacker can exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files. Both outcomes are enabled through crafted path traversal parameters.

CVE-2026-93328: Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What access does an attacker need to exploit the issue?

What could an attacker do on a compromised deployment?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What access does an attacker need to exploit the issue?

What could an attacker do on a compromised deployment?