---
id: CVE-2026-93328
title: >-
  Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read
  and Write
summary: >-
  Path Traversal and Missing Authorization in cloud-storage source in Google
  Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0
  through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host
  files to extern…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber'
cvssSource: cna
cwe:
  - CWE-862
  - CWE-22
vendor: Google Cloud
product: MCP Toolbox for Databases (googleapis/mcp-toolbox)
affected:
  - mcp_toolbox_for_databases_googleapis_mcp-toolbox >= 1.2.0 < 1.5.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-26T15:33:21.057931Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T16:46:45.879Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93328'
references:
  - url: 'https://github.com/googleapis/mcp-toolbox/pull/3454'
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.534Z'
---

## Overview

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

## Affected

- `mcp_toolbox_for_databases_googleapis_mcp-toolbox >= 1.2.0 < 1.5.0`

## Remediation

Upgrade googleapis/mcp-toolbox to version 1.5.0 or later.

Configure the security boundaries introduced in v1.5.0 by setting allowedLocalRoots to restrict host file system interactions strictly to designated, isolated directories set allowedBuckets to ensure the tool only reads from and writes to explicit, authorized Google Cloud Storage buckets.

Follow the Principle of Least Privilege by running the Toolbox service under an unprivileged OS user account and restricting associated Google Cloud IAM permissions.