CVE-2026-93328

critical · 9.3

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

9.3

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-10-26

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Weaknesses

CWE-22CWE-862

References

https://github.com/googleapis/mcp-toolbox/pull/3454

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-93328