CVE-2026-93328
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
| CWE | CWE-862 CWE-22 |
| Vendor | google cloud |
| Product | mcp toolbox for databases (googleapis/mcp-toolbox) |
| Published | Oct 26, 2026 |
| Last Updated | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for google cloud mcp toolbox for databases (googleapis/mcp-toolbox)
Be the first to know when new unknown vulnerabilities affecting google cloud mcp toolbox for databases (googleapis/mcp-toolbox) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Google Cloud / MCP Toolbox for Databases (googleapis/mcp-toolbox)
1.2.0 < 1.5.0
References
Credits
🔍 He Wei (gikaku)