Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
Summary
| CVE | CVE-2026-93328 |
|---|---|
| State | PUBLISHED |
| Assigner | GoogleCloud |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-26 15:16:45 UTC |
| Updated | 2026-10-26 17:17:31 UTC |
| Description | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. |
Risk And Classification
Primary CVSS: v4.0 9.3 CRITICAL from f45cbf4e-4146-4068-b7e1-655ffc2c548c
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Problem Types: CWE-22 | CWE-862 | CWE-862 CWE-862 Missing Authorization | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | f45cbf4e-4146-4068-b7e1-655ffc2c548c | Secondary | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/C... |
| 4.0 | CNA | CVSS | 9.3 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Google Cloud | MCP Toolbox For Databases Googleapis/mcp-toolbox | affected 1.2.0 1.5.0 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/googleapis/mcp-toolbox/pull/3454 | f45cbf4e-4146-4068-b7e1-655ffc2c548c | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: He Wei (gikaku) (en)
Additional Advisory Data
Solutions
CNA: Upgrade googleapis/mcp-toolbox to version 1.5.0 or later. Configure the security boundaries introduced in v1.5.0 by setting allowedLocalRoots to restrict host file system interactions strictly to designated, isolated directories set allowedBuckets to ensure the tool only reads from and writes to explicit, authorized Google Cloud Storage buckets. Follow the Principle of Least Privilege by running the Toolbox service under an unprivileged OS user account and restricting associated Google Cloud IAM permissions.