Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0…
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Product
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- CVSS v4.0
- 9.3 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
- EPSS
- 0.005 (p45)
- Weakness
- CWE-22, CWE-862
- Exposure class
- Cloud platform
- NVD status
- Received
Why it ranks 31 (Notable)
- CVSS v4.0 9.3 critical
- Product class: cloud platform
- Widely deployed vendor product (Google)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-93328 on this site · NVD · CVE.org · Vulnpedia