CVE-2026-93328
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
CRITICAL 9.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 44 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GoogleCloud
- NVD status
- Awaiting Analysis
Description
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | CRITICAL 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber | GoogleCloud |
| CVSS 4.0 | CRITICAL 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber | NVD · f45cbf4e-4146-4068-b7e1-655ffc2c548c (Secondary) |
European references
- ENISA EUVD · EUVD-2026-109936
- GCVE · GCVE-0-2026-93328
Affected products
| Product | Versions |
|---|---|
| Google Cloud · MCP Toolbox for Databases (googleapis/mcp-toolbox) | affected 1.2.0 < 1.5.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |