{"id":"CVE-2026-93328","revision":"48a1fd0e223149a4b1a58f8a3aa67e7a","records":[{"revision":"48a1fd0e223149a4b1a58f8a3aa67e7a","observedAt":"2026-10-26T15:35:30.984+00:00","statement":{"source":"cve-program","id":"CVE-2026-93328","aliases":[],"title":"Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write","description":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.","state":0,"publishedAt":"2026-10-26T14:24:09.012+00:00","modifiedAt":"2026-10-26T14:24:09.012+00:00","affected":[{"ecosystem":"Vendor product","name":"MCP Toolbox for Databases (googleapis/mcp-toolbox)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Google Cloud\",\n                    \"product\": \"MCP Toolbox for Databases (googleapis/mcp-toolbox)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.2.0\",\n                            \"lessThan\": \"1.5.0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/googleapis/mcp-toolbox/pull/3454"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93328","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93328","identifiers":["CVE-2026-93328"]},"retained":false,"historicalAffected":[]}],"coverage":[]}