Skip to content
fr Sign in
8.6 High

CVE-2026-15829 A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery…

Description

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. The tool accepts client-controlled parameters (data_col, timestamp_col, and id_cols) as plain strings and interpolates them unescaped via fmt.Sprintf directly into a generated AI.FORECAST table-valued SELECT statement. While MCP Toolbox utilizes an allowedDatasets mechanism to restrict queries, this defense only validates the history_data parameter; the final assembled query is executed without re-validation. An attacker can break out of the string literal fields (such as timestamp_col) to inject a valid multi-statement or cross-dataset query block. This allows an unauthorized user to bypass the operator-configured allowedDatasets boundary and read arbitrary BigQuery tables.

Affected products and versions

Product Affected versions Fixed in
MCP Toolbox for Databases (googleapis/mcp-toolbox) 0.13 0.13.0 → 1.3.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of MCP Toolbox for Databases (googleapis/mcp-toolbox)

The 6 CVEs of MCP Toolbox for Databases (googleapis/mcp-toolbox) →
CVE-2026-16481 A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the… 6.0 Medium CVE-2026-11720 A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox 9.3 Critical CVE-2026-11719 An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement… 8.6 High CVE-2026-11718 An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of… 9.3 Critical
Track this CVE