9.3 Critical

CVE-2026-93328 Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases…

Description

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

Affected products and versions

Product	Affected versions	Fixed in
MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.2	1.2.0 → < 1.5.0	1.5.0

Do you use MCP Toolbox for Databases (googleapis/mcp-toolbox)?

Track this CVE Watch MCP Toolbox for Databases (googleapis/mcp-toolbox) Check my SBOMs

www.cveye.io/en/cve/CVE-2026-93328

Timeline

Published October 26, 2026
Last modified October 26, 2026

References

github.com github.com

Track this CVE