Google mcp-toolbox up to 1.4.0 BigQuery Execute-Sql Tool improper authorization

Summaryinfo

A vulnerability identified as problematic has been detected in Google mcp-toolbox up to 1.4.0. This vulnerability affects unknown code of the component BigQuery Execute-Sql Tool. Performing a manipulation results in improper authorization. This vulnerability is identified as CVE-2026-14538. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Google mcp-toolbox up to 1.4.0. It has been classified as problematic. This affects some unknown functionality of the component BigQuery Execute-Sql Tool. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-14538 since 07/03/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/31/2026). MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Google

Name

• mcp-toolbox

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion