Google Cloud MCP Toolbox for Databases cloud storage source has path traversal and missing authorization vulnerabilities (CVE-2026-93328)
AI summary
The cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 to 1.4.0 has path traversal and missing authorization vulnerabilities, tracked as CVE-2026-93328, with a severity level of Critical. An unauthenticated remote attacker can, by crafting tool invocation parameters, exfiltrate host files to an external Google Cloud Storage bucket and overwrite arbitrary local files. The advisory was published to the GitHub Advisory Database on October 26, 2026, and the page lists the fixed version as unknown.
Why it was selected
Teams deploying this MCP server can use this to verify the version in use and check the authorization configuration of the cloud storage tool to prevent exfiltration of host files.