MCP Toolbox for Databases: arbitrary file read and write

MCP Toolbox for Databases

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation…

Do this now

Upgrade MCP Toolbox for Databases (googleapis/mcp-toolbox) to 1.5.0.

Fix it

Upgrade to MCP Toolbox for Databases (googleapis/mcp-toolbox) 1.5.0

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 05:17 UTC
Fixed in: 1.5.0
Identifiers: CVE-2026-93328
CVSS: 9.3
Source: news
On the menu as: MCP servers
Google Cloud

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## MCP Toolbox for Databases: arbitrary file read and write
Severity: critical. Patch status: patched.
Affected: MCP Toolbox for Databases
Fixed in: 1.5.0
Ids: CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation…

## Steps
1. This incident involves a provider (gcp). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.
2. Fix by release line: MCP Toolbox for Databases (googleapis/mcp-toolbox): 1.5.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| MCP Toolbox for Databases (googleapis/mcp-toolbox) | fixed | 1.5.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-93328") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/googleapis/mcp-toolbox/pull/3454 https://nvd.nist.gov/vuln/detail/CVE-2026-93328
https://pwned.coffee/i/path-traversal-and-missing-authorization-in-cloud-storag-cve-2026-93328

Timeline

27 Oct 2026, 05:17 UTC
Fix status: unknown → patched.
27 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “CVE-2026-93328 (CNA Google Cloud), title: "Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write"; versions 1.2.0 through 1.4.0 affected, fixed in 1.5.0.” source
Fix by release line: Product Affected Fixed in Source
MCP Toolbox for Databases (googleapis/mcp-toolbox) before 1.5.0 1.5.0 CVE record (CNA) checked 27 Oct
Score: CVSS 9.3 (critical). CVSS 4.0 9.3 (CNA GoogleCloud) for CVE-2026-93328
Last checked: 27 Oct 2026, 06:19 UTC

Product	Affected	Fixed in	Source
MCP Toolbox for Databases (googleapis/mcp-toolbox)	before 1.5.0	1.5.0	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee