CRITICAL 9.3 NVD

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

References

https://github.com/googleapis/mcp-toolbox/pull/3454

Published: 2026-10-26 · Source: NVD · Feed updated: 2026-10-26

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-26 via NVD.

Risk Timeline

CVE Disclosed2026-10-26 · -1 days ago

Remediation Resources

GitHub

github.com/googleapis/mcp-toolbox/pull/3454

vulnfeed aggregates 18200 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.