CVE-2026-93328 in MCP Toolbox for Databases
Summary
by MITRE • 10/26/2026
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in the cloud-storage source component of the Google Cloud MCP Toolbox for Databases, specifically affecting versions 1.2.0 through 1.4.0, represents a critical security failure involving both path traversal and missing authorization controls. This flaw allows an unauthenticated remote attacker to interact with the underlying file system without proper validation or access restrictions. The core technical issue stems from insufficient sanitization of user-supplied input within tool invocation parameters. When these parameters are processed by the application, they fail to adequately restrict directory navigation sequences such as dot-dot-slash characters. This lack of normalization allows attackers to break out of the intended sandboxed environment and reference arbitrary files located on the host system rather than being confined to the designated storage directories.
The operational impact of this vulnerability is severe due to its dual nature, enabling both data exfiltration and file manipulation. An attacker can exploit the path traversal weakness to read sensitive configuration files, credentials, or other proprietary data stored on the server hosting the MCP Toolbox instance. By crafting specific tool invocation parameters that include relative path sequences leading to critical system locations, the attacker gains unauthorized access to information that should remain isolated from external requests. This capability effectively bypasses standard isolation boundaries, turning a database management utility into a vector for comprehensive host compromise and data leakage.
Furthermore, the missing authorization aspect of this vulnerability permits an unauthenticated user to overwrite arbitrary local files on the target system. By manipulating file paths within the tool parameters, an attacker can direct write operations to locations outside the intended scope, potentially overwriting executable binaries, configuration scripts, or other critical system files. This capability not only disrupts service availability but also provides a foothold for further exploitation, such as achieving remote code execution if sensitive executables are replaced with malicious payloads. The combination of reading and writing capabilities without authentication significantly lowers the barrier to entry for attackers seeking to compromise the integrity and confidentiality of the hosting environment.
From an industry standards perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can resolve to unintended directories or files. Additionally, the lack of authentication for critical operations corresponds to CWE-306: Missing Authentication for Critical Function, indicating that the system fails to require appropriate credentials before allowing actions that could impact security posture. In terms of attack tactics, this scenario reflects techniques associated with ATT&CK ID T1552.004 Unsecured Credentials and potentially T1083 File and Directory Discovery, as attackers leverage these flaws to gather information about the system structure and sensitive data stored therein.
Mitigation strategies must prioritize immediate updates to patched versions of the Google Cloud MCP Toolbox for Databases that address these input validation and access control deficiencies. Administrators should ensure that all instances are upgraded beyond version 1.4.0 where these issues have been resolved through stricter parameter sanitization and enforced authentication mechanisms. In environments where upgrading is not immediately feasible, network-level controls such as firewalls can be configured to restrict inbound traffic to the MCP Toolbox service only from trusted IP addresses, thereby reducing the attack surface available to unauthenticated remote actors. Additionally, implementing strict file system permissions on the host operating level can limit the impact of any successful exploitation by ensuring that even if path traversal occurs, the application process lacks write access to critical system directories or read access to sensitive configuration files. Regular auditing of tool invocation logs for anomalous path sequences should also be implemented to detect potential probing attempts early in the attack lifecycle.