CVE-2026-93328

Vendor

Google

Product

MCP Toolbox for Databases (googleapis/mcp-toolbox)

CVSS v4.0

9.3 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

EPSS

0.005 (p45)

Weakness

CWE-22, CWE-862

Exposure class

Cloud platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 31
   CVE NVD 5d ago

   Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0…

   Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files…

   CVSS 9.3 CVE-2026-93328 Google