Skip to content
AI Security Wire

Published

- 4 min read

By

Google MCP Toolbox Flaw Lets Remote Callers Read and Overwrite Host Files

MCP CVE-2026-93328 Google path traversal agentic AI cloud storage
img of Google MCP Toolbox Flaw Lets Remote Callers Read and Overwrite Host Files

Google’s MCP Toolbox for Databases has a path traversal bug in its Cloud Storage source, rated critical by the CNA. A change that appears to address it exists, but it only works if you turn it on.

The CVE record for CVE-2026-93328 was published on October 26, 2026. It covers googleapis/mcp-toolbox versions 1.2.0 through 1.4.0. The description says that missing authorization and path traversal in the cloud-storage source “allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.”

What the record says

The CVSS 4.0 score is 9.3, with a network vector, low complexity and no privileges or user interaction required. That score comes from a CNA listed in the record, which we did not resolve to a named organisation. NVD lists it as a secondary score and the record was still “Awaiting Analysis” when we checked, so there is no NVD-primary rating yet. The GitHub advisory entry lists CWE-22, path traversal. The NVD record also lists CWE-862, missing authorization.

MCP Toolbox is a server that exposes database and cloud resources as tools for AI agents. Its cloud-storage source, per the pull request, has tools that list, read and create objects in buckets and manage bucket metadata, and upload and download files between buckets and the machine running the server. The CVE says an attacker who can invoke those tools can point them at paths and buckets the operator never meant to expose. In one direction that means host files copied out to a bucket the attacker chooses. In the other it means local files overwritten.

The word “unauthenticated” is the CVE’s. Whether a given deployment is reachable without credentials depends on how the Toolbox server is exposed and what auth is placed in front of it. We have not tested that.

The fix is opt-in

The CVE record does not list a fixed version and links only to a pull request: googleapis/mcp-toolbox #3454, “restrict bucket and local path access”. It was merged on June 18, 2026, and the v1.5.0 release notes of the same date list it under features.

The change adds two optional settings to the cloud-storage source: allowedBuckets and allowedLocalRoots. Per the docs added in the pull request, “If omitted, all buckets are allowed” and “If omitted, all paths are allowed.” The code mirrors that: an empty list means no allowlist check. So a config that was exposed in 1.4.0 stays just as open in 1.5.0 or later until someone writes the allowlists.

That matters for patch tracking. A scanner that reads “upgraded past 1.4.0” will mark the host clean. By our reading of the pull request, it is not clean until the allowlists are set. We found no evidence of a separate Google advisory as of October 26, 2026 in the NVD record, the GitHub advisory entry or the pull request, and the pull request credits the report to “HE WEI”.

There is also a four-month gap. The code change landed in June and the CVE appeared in late October. Anyone who relied on CVE feeds to learn about this issue heard about it months after the release that appears to address it.

What to do

Our suggestions, not Google’s:

  1. Check whether any of your Toolbox deployments use a cloud-storage source and which version they run.
  2. Upgrade to the latest release (1.5.0 is the first to contain the change), then add allowedBuckets and allowedLocalRoots to every cloud-storage source. Keep the local roots narrow and the bucket list short. Note that the pull request does not appear to gate the list-buckets tool, so set that tool’s project argument carefully too.
  3. Put authentication in front of the Toolbox server, and do not expose it to untrusted networks.
  4. Review the service account the source runs as. Tool invocations act with its permissions, so trim them.
  5. Look at bucket access logs and file modification times for activity you cannot explain, going back to when 1.2.0 was deployed.

We found no evidence of exploitation as of October 26, 2026 in the NVD record, the GitHub advisory entry or CISA’s KEV feed (snapshot released October 23, which predates the CVE). The same pattern keeps turning up in agent tooling, though: a tool that touches the filesystem or object storage, parameters the model or caller controls, and restrictions that are off by default.

References

Frequently Asked Questions

Which versions of MCP Toolbox for Databases are affected by CVE-2026-93328?
The CVE record lists googleapis/mcp-toolbox versions 1.2.0 through 1.4.0, and only the cloud-storage source. The record does not name a fixed version. The pull request that adds the bucket and path restrictions was merged on June 18, 2026 and appears in the v1.5.0 release notes, so 1.5.0 or later is where those controls exist. That link is our reading of the release notes, not a statement from Google.
Does upgrading to 1.5.0 or later fix it on its own?
Not by itself, based on the code and docs in the pull request. The new allowedBuckets and allowedLocalRoots settings are optional, and the documentation says that if they are omitted, all buckets and all local paths are allowed. You need to add the allowlists to your cloud-storage source configuration. We have not tested a running instance.
Is CVE-2026-93328 being exploited?
We found no evidence of exploitation as of October 26, 2026 in the NVD record, the GitHub advisory entry or CISA's KEV feed (snapshot released October 23, which predates the CVE). The CVE was published the same day, so that absence says little. NVD had not yet analysed the record and lists only a CNA-supplied score.