CVE-2026-14538 in mcp-toolbox
Summary
by MITRE • 07/31/2026
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
This vulnerability represents a critical authorization flaw in Google's mcp-toolbox component that undermines fundamental security boundaries within BigQuery environments. The issue resides in the bigquery-execute-sql tool where proper dataset validation mechanisms have been circumvented through a design flaw in the dry-run API integration. The vulnerability affects versions 0.16.1 through 1.4.0 of the mcp-toolbox, creating a persistent risk across multiple releases where authenticated users can exploit a fail-open condition to bypass intended access controls.
The technical implementation of this vulnerability stems from how the toolbox handles responses from the BigQuery dry-run API when processing specialized SQL constructs. When the API returns an empty array for certain query patterns, the system's logic incorrectly interprets this as a successful validation rather than a failure state. This fail-open behavior creates a security boundary bypass that allows attackers to traverse normally restricted dataset access controls. The vulnerability specifically targets the allowedDatasets validation checks that should prevent unauthorized access to sensitive data repositories.
The operational impact of this vulnerability extends beyond simple data access violations to encompass comprehensive schema discovery and data extraction capabilities. Attackers can leverage this flaw to extract structural DDL schemas through INFORMATION_SCHEMA queries against datasets that should be explicitly excluded from their access scope. Additionally, the vulnerability enables access to downstream federated row data via EXTERNAL_QUERY connections, potentially exposing interconnected data sources that may contain sensitive or confidential information. This dual capability of schema enumeration and data extraction creates a significant risk for organizations relying on dataset-level security controls.
This vulnerability maps directly to CWE-285: Improper Authorization and aligns with ATT&CK technique T1078: Valid Accounts, as it exploits authenticated access to perform unauthorized operations. The flaw demonstrates poor input validation and error handling practices where system responses that should trigger security alerts instead enable privilege escalation. Organizations using this toolbox component face risks of data leakage, compliance violations, and potential exposure of intellectual property or sensitive business information.
Mitigation strategies should focus on immediate version upgrades to patched releases of the mcp-toolbox where the fail-open logic has been corrected. Security teams must implement additional monitoring for unauthorized INFORMATION_SCHEMA queries and EXTERNAL_QUERY operations. Network-level controls should be enhanced to restrict access to BigQuery APIs, and organizations should conduct comprehensive audits of dataset access controls to identify potential exploitation. The fix requires proper error handling implementation that treats empty API responses as validation failures rather than successful authorizations, ensuring that all security boundary checks maintain their intended protective function against unauthorized data access patterns.