CVE-2026-93328

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

En bref

Sévérité: CRITICAL 9.3
EPSS: EPSS 0.53 % · centile 44 (2026-10-27)
État: PUBLISHED
Publiée: 2026-10-26
Mise à jour: 2026-10-26
Attribuée par: GoogleCloud
Statut NVD: Awaiting Analysis

Description

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	CRITICAL 9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber	GoogleCloud
CVSS 4.0	CRITICAL 9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber	NVD · f45cbf4e-4146-4068-b7e1-655ffc2c548c (Secondary)

Faiblesses (CWE)

Références européennes

ENISA EUVD · EUVD-2026-109936
GCVE · GCVE-0-2026-93328

Produits affectés

Produit	Versions
Google Cloud · MCP Toolbox for Databases (googleapis/mcp-toolbox)	affected 1.2.0 < 1.5.0

Références

https://github.com/googleapis/mcp-toolbox/pull/3454

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD