CVE-2026-93328criticalCWE-22CWE-862

CVE-2026-93328: critical vulnerability in Google Cloud MCP Toolbox for Databases…

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Published

Follow this CVE+ Monitor MCP Toolbox for Databases

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.3epss 0.5%
from disclosure to weapon1 day
Published on NVDOct 26
1st PoC+1d
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber
Affected products
Google Cloud · MCP Toolbox for Databases (googleapis/mcp-toolbox)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.