Paper/Archive/CVE-2026-93328

CVE-2026-93328

Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) — Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

EPSS 0.5%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 44.5.445 × 208.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

Affected

ProductAffectedFixed inSource

MCP Toolbox for Databases (googleapis/mcp-toolbox)1.2.0 – < 1.5.01.5.0CNA

Scores by source

GoogleCloud (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/googleapis/mcp-toolbox/pull/3454