Skip to content
Threat Feed
Subscribe
critical advisory

Google Cloud MCP Toolbox for Databases: Path traversal and missing authorization (CVE-2026-93328)

An unauthenticated remote attacker can exploit CVE-2026-93328 in Google Cloud MCP Toolbox for Databases to perform arbitrary file exfiltration or local file overwriting due to insufficient path validation.

CVE search metadata

CVE search record: CVE-2026-93328. KEV: no. Product: Google Cloud MCP Toolbox for Databases (1.2.0-1.4.0). Brief: Google Cloud MCP Toolbox for Databases: Path traversal and missing authorization (CVE-2026-93328). Brief link: https://feed.craftedsignal.io/briefs/2026-10-google-mcp-toolbox-cve-93328/

Triage facts

Revision 1
Applicability
Google Cloud MCP Toolbox for Databases (1.2.0-1.4.0)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
3 public sources
Freshness
Revision 1Oct 27, 08:31 UTC
Vulnerabilities
1 CVE
Source quality
B2Very likely

CVE-2026-93328 (GHSA-2gc9-c85v-5vwr) is a critical vulnerability in the cloud-storage source of the Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. The vulnerability allows an unauthenticated remote attacker to perform path traversal and access host files because the internal path validation function only enforces a format contract rather than actual filesystem confinement. The tool executes with the ambient filesystem authority of the server process, enabling attackers to exfiltrate host files to external Google Cloud Storage buckets or overwrite arbitrary local files.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the host filesystem (such as SSH keys or application secrets) or overwrite files, leading to full system compromise or persistence.

Recommendation

  • Upgrade Google Cloud MCP Toolbox for Databases to a version beyond 1.4.0.
  • After upgrading, explicitly configure allowedBuckets and allowedLocalRoot options, as the default configuration may remain vulnerable even after patching.
  • Implement strict network isolation for any service running AI agent tooling to prevent reachability of the database toolbox from untrusted segments.

Immediate actions

Upgrade Google Cloud MCP Toolbox for Databases to the latest patched version and verify allowlist configurations.

IT Operations 24h

Threat Hunt

Monitor webserver logs for requests to cloud-storage tool endpoints (upload/download) containing path traversal characters like ".." or absolute paths pointing to sensitive files (e.g., /etc/passwd, .ssh/id_rsa).

T1190 high high confidence hunt now

Data: Web server access logs

Mitigations

Upgrade to post-1.4.0 and enforce allowedBuckets/allowedLocalRoot settings.

immediate IT Operations

CVE-2026-93328