Vulnerability details
CVE-2026-93328
Google Cloud MCP Toolbox for Databases
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
CVSS 4.0
9.3Critical
Official description
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (GoogleCloud) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Google Cloud | MCP Toolbox for Databases (googleapis/mcp-toolbox) | 1.2.0 ≤ v < 1.5.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-26
- Last updated
- 2026-10-26
- State
- Published
- Assigner (CNA)
- GoogleCloud
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
0.52%
Probability of exploitation in 30 days
44.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-862Missing Authorization
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')