High severity · published Sep 29, 2026
CVE-2026-102242
Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MCP Toolbox for Databases · Google
1.2.0 through 1.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102242
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102242
github.com
https://github.com/googleapis/mcp-toolbox/pull/3810
More from MCP Toolbox for Databases
9.8
CVE-2026-14537
Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
9.4
CVE-2026-11624
The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks
9.4
CVE-2026-9739
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790)
9.1
CVE-2026-11720
Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
9.1
CVE-2026-11718
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox