{"id":"CVE-2026-93328","kind":"vulnerability","aliases":["CVE-2026-93328"],"related":[],"title":"Google MCP Toolbox: cloud-storage flaw lets attackers read and overwrite host files","description":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.","summary":"Google Cloud MCP Toolbox for Databases, versions 1.2.0 through 1.4.0, has a path traversal and missing authorization flaw in its cloud-storage source. An unauthenticated remote attacker can send crafted tool invocation parameters to copy host files to external Google Cloud Storage buckets and overwrite arbitrary local files.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cloud-storage","google-cloud","mcp","self-hosted"],"not_affected_if":["cloud-storage-source-disabled","version-outside-1.2.0-1.4.0"],"how_to_check":"- Check the installed toolbox version with `toolbox --version` or the running container image tag; versions `1.2.0` through `1.4.0` are affected.\n- Check whether the cloud-storage source is configured in the toolbox tools file (`tools.yaml`).","fix":"- Upgrade Google Cloud MCP Toolbox for Databases to a version later than `1.4.0`; the sources do not name the fixed version, so check the googleapis/mcp-toolbox release notes.\n- Until upgraded, remove or disable the cloud-storage source from the toolbox configuration.","status":"open","published_at":"2026-10-26T15:16:45+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:33+00:00","updated_at":"2026-10-26T16:03:33+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-26T16:03:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Google Cloud MCP Toolbox for Databases to a version later than `1.4.0`; the sources do not name the fixed version, so check the googleapis/mcp-toolbox release notes.\n- Until upgraded, remove or disable the cloud-storage source from the toolbox configuration.","reach":"internet","title":"Google MCP Toolbox: cloud-storage flaw lets attackers read and overwrite host files","impact":"high","summary":"Google Cloud MCP Toolbox for Databases, versions 1.2.0 through 1.4.0, has a path traversal and missing authorization flaw in its cloud-storage source. An unauthenticated remote attacker can send crafted tool invocation parameters to copy host files to external Google Cloud Storage buckets and overwrite arbitrary local files.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","google-cloud","cloud-storage","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker exfiltrates host files and overwrites arbitrary local files.","analyst_note":"Find the fixed version and advisory text at the googleapis/mcp-toolbox repository and the NVD entry for CVE-2026-93328.","how_to_check":"- Check the installed toolbox version with `toolbox --version` or the running container image tag; versions `1.2.0` through `1.4.0` are affected.\n- Check whether the cloud-storage source is configured in the toolbox tools file (`tools.yaml`).","needs_analyst":true,"not_affected_if":["cloud-storage-source-disabled","version-outside-1.2.0-1.4.0"],"who_is_affected":"Teams that run Google Cloud MCP Toolbox for Databases in versions 1.2.0 through 1.4.0 with the cloud-storage source enabled are exposed, since the flaw is reachable through crafted tool invocations without authentication. Deployments without the cloud-storage source configured, or running outside the affected version range, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000708,"input_tokens":3357,"output_tokens":745,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-93328':17A,20A '1.2.0':41B,102C '1.4.0':43B,104C 'ai':22B 'ai-tool':21B 'allow':105C 'arbitrari':80B,122C 'attack':9A,61B,109C 'author':50B,87C 'bucket':77B,119C 'cloud':5A,25B,29B,35B,55B,75B,90C,95C,117C 'cloud-storag':4A,24B,54B,89C 'copi':69B 'craft':64B,126C 'cve':15A,18A 'databas':39B,99C 'exfiltr':111C 'extern':73B,115C 'file':14A,71B,82B,113C,124C 'flaw':7A,51B 'googl':1A,28B,34B,74B,94C,116C 'google-cloud':27B 'googleapis/mcp-toolbox':100C 'host':13A,33B,70B,112C 'invoc':66B,128C 'let':8A 'local':81B,123C 'mcp':2A,30B,36B,96C 'miss':49B,86C 'overwrit':12A,79B,121C 'paramet':67B,129C 'path':46B,83C 'read':10A 'remot':60B,108C 'self':32B 'self-host':31B 'send':63B 'sourc':57B,92C 'storag':6A,26B,56B,76B,91C,118C 'tool':23B,65B,127C 'toolbox':3A,37B,97C 'travers':47B,84C 'unauthent':59B,107C 'version':40B,101C 'via':125C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Google Cloud MCP Toolbox for Databases in versions 1.2.0 through 1.4.0 with the cloud-storage source enabled are exposed, since the flaw is reachable through crafted tool invocations without authentication. Deployments without the cloud-storage source configured, or running outside the affected version range, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","cvss_by":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93328","severity":null,"published_at":"2026-10-26T15:16:45+00:00","modified_at":"2026-10-26T15:16:45+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}