Google Cloud MCP Toolbox for Databases: Path traversal and missing authorization in cloud-storage source

Summary

Versions 1.2.0 through 1.4.0 of the MCP Toolbox for Databases contain a path traversal and missing authorization flaw in the cloud-storage source. An unauthenticated remote attacker can craft tool invocation parameters to copy host files to external Google Cloud Storage buckets and overwrite arbitrary local files. The flaw is reachable without authentication, so HTTP-exposed instances with cloud-storage tools enabled are at highest risk.

Affected

• Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.2.0 to before 1.5.0
• Default configuration: unaffected according to the CVE record (wording unclear, see recommendation)

Fixed in

• Version 1.5.0 (fix: restrict bucket and local path access, PR #3454)
• Confirm against Google's official advisory, as no Google security bulletin was found during research

Workaround

• Set allowedLocalRoots to narrow, isolated directories and allowedBuckets to explicit buckets in the cloud-storage source
• Do not add / to allowedLocalRoots
• Run the Toolbox service as an unprivileged OS user and restrict its Google Cloud IAM permissions
• Remove cloud-storage tools if not used and restrict network access to the Toolbox endpoint

Exploitation

• CISA KEV: not listed
• EPSS: below 1 percent
• CISA SSVC: exploitation none, automatable yes, technical impact total
• No confirmed in-the-wild exploitation found; public technical discussion exists, so exploitation attempts are possible once details spread

Our recommendation

• Upgrade to MCP Toolbox 1.5.0 or later
• Do not rely on the upgrade alone: explicitly configure allowedLocalRoots and allowedBuckets, because an open PR (#4345) reports that local file access is unrestricted when allowedLocalRoots is omitted
• Check whether the Toolbox is reachable from the internet, especially HTTP deployments such as Cloud Run
• Review logs for unexpected cloud storage uploads and file changes, and rotate service account credentials if misuse is suspected
• Run the service with least privilege

Research sources

• GitHub Pull Request #3454 (fix) github.com
• GitHub Pull Request #4345 (open, fail-open report) github.com
• MCP Toolbox cloud-storage source documentation mcp-toolbox.dev
• GitHub Advisory GHSA-2gc9-c85v-5vwr github.com
• OffSeq radar entry for CVE-2026-93328 radar.offseq.com
• OpenCVE CVE-2026-93328 app.opencve.io
• LinuxSecurity news on MCP Toolbox host file access linuxsecurity.com
• Google Cloud Storage pre-built tools with MCP Toolbox docs.cloud.google.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:41.