Google MCP Toolbox Flaw Could Leak Host Files

Google Cloud on Monday, Oct. 26, published a critical vulnerability in MCP Toolbox for Databases, its open-source server that connects AI coding assistants to Google data services. The flaw, CVE-2026-93328, sits in the tool's Cloud Storage connector and lets an attacker copy files off the host or overwrite local files, according to the CVE record.

The bug affects versions 1.2.0 through 1.4.0 and was fixed in 1.5.0, a release that shipped on June 18. That means the public disclosure came more than four months after the patch.

Key takeaways

• CVE-2026-93328 is rated 9.3 out of 10 under CVSS 4.0. It requires no login and no user interaction.
• Upgrading to 1.5.0 or later is the fix, but Google also tells users to set bucket and local-path allowlists and to run the server under a low-privilege account.
• It is the second critical path-traversal CVE in the same project this year, after CVE-2026-11720 in June.

What the MCP Toolbox Cloud Storage flaw does

The CVE record, filed by Google Cloud as the CVE numbering authority, combines two weaknesses: path traversal (CWE-22) and missing authorization (CWE-862). An unauthenticated remote attacker could use "crafted tool invocation parameters" to "exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files," the record says.

In practice, the tool calls an AI agent sends to the server could point at files and buckets the operator never meant to expose. Google's own setup guide lists an upload_object tool that "uploads a local file to an object" and a download_object tool that "downloads an object to a local path." The guide says the Cloud Storage tools require Toolbox 1.2.0 or later, the first affected version.

The CVSS 4.0 vector marks the attack as network-based, low in complexity and requiring no privileges. A CISA assessment attached to the record lists exploitation as "none," the attack as automatable and the technical impact as "total."

How the fix works

The patch, pull request #3454, is titled "restrict bucket and local path access." It adds an allowedBuckets setting and a matching limit on local file paths. According to the pull request, both settings allow everything by default.

That is why the record's guidance goes beyond the upgrade. Google advises users to move to 1.5.0 or later, set both allowlists, and run the service under an unprivileged operating-system account with restricted IAM permissions. The record credits researcher He Wei (gikaku) with reporting the issue.

Release timeline

Release dates come from the project's GitHub release history as tracked by ReleaseAlert; CVE dates come from the CVE record.

Context: MCP servers as a new attack surface

The project already disclosed one critical bug this year. CVE-2026-11720, published June 29 and also rated 9.3, let path parameters in the HTTP tool escape their configured scope and send requests carrying the toolbox's credentials to other endpoints on the same host. It was fixed in 1.3.0.

Google's guide shows the Cloud Storage tools being wired into Cursor, Windsurf, VS Code, Cline, Claude Desktop, Claude Code and Antigravity. Agents connected this way act with the user's cloud credentials, and researchers have documented agents that turned to SQL injection when ordinary requests failed, which makes tight server-side limits more important.

What's next

NVD analysis of the CVE is still pending. Teams that pinned Toolbox between 1.2.0 and 1.4.0 should upgrade and then set the allowlists explicitly, since the new settings are permissive unless configured.

FAQ

Which versions are affected?

MCP Toolbox for Databases 1.2.0 through 1.4.0. Version 1.5.0, released June 18, and later releases contain the fix.

Has the flaw been exploited?

The CISA assessment on the record lists exploitation as "none." Google has not reported attacks.

Is upgrading enough?

Not fully. Google recommends also setting allowedBuckets and the local-path allowlist, and running the server with minimal OS and IAM permissions.

References

• CVE-2026-93328: Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write — CVE Program / Google Cloud (Oct. 26, 2026)
• feat(source/cloud-storage): restrict bucket and local path access — GitHub, googleapis/mcp-toolbox
• Connect LLMs to Cloud Storage with MCP — Google Cloud documentation (updated Aug. 26, 2026)
• CVE-2026-11720 — OpenCVE (June 29, 2026)
• CVE-2026-93328 — Strix