CVE-2026-93328

Vulnerability Description

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

Related Weaknesses (CWE)

CWE-862 CWE-22

References

https://github.com/googleapis/mcp-toolbox/pull/3454

FAQ

What is CVE-2026-93328?

CVE-2026-93328 is a documented vulnerability. Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attack...

How severe is CVE-2026-93328?

CVSS scoring is not yet available for CVE-2026-93328. Check NVD for updates.

Is there a patch for CVE-2026-93328?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.