Critical severity · published Oct 26, 2026
CVE-2026-93328
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
New
9.3
CVSS
0.5%
EPSS
No
On KEV
Description
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MT
MCP Toolbox for Databases (googleapis/mcp-toolbox) · Google Cloud
1.2.0 before 1.5.0 · source: vendor
Affected product
MT
MCP Toolbox for Databases (googleapis/mcp-toolbox)
Google Cloud