Google MCP Toolbox CVE-2026-93328: upgrading isn't enough

A critical bug in Google's MCP Toolbox for Databases, now tracked as CVE-2026-93328, lets an unauthenticated attacker copy files off the host into an outside Google Cloud Storage bucket and overwrite local files. It scores 9.3 on CVSS 4.0. The fix shipped in June. The catch: the protection is a config setting, and per the fix itself, the default still allows everything. If you run MCP Toolbox with a Cloud Storage source, a version bump alone may not close this.

What actually happened

The CVE record went public on October 26. The CVE record, filed by Google Cloud as the CNA, gives these details:

• Product: MCP Toolbox for Databases (googleapis/mcp-toolbox), the open-source MCP server that connects AI agents to databases and Google Cloud data sources.
• Affected: versions 1.2.0 up to, but not including, 1.5.0.
• Weakness: path traversal (CWE-22) and missing authorization (CWE-862) in the cloud-storage source. Crafted tool-call parameters can push host files to an external GCS bucket or overwrite arbitrary local files.
• Attack bar: network-reachable, no privileges, no user interaction.

The fix is pull request #3454. It was merged on June 18, 2026 and shipped in v1.5.0. It adds two settings, allowedBuckets and allowedLocalRoot, and checks every bucket and object operation against them. The PR states that the default allows everything, so the limits only apply when you configure them. A later release, v1.10.0, also resolves symlinks when it enforces local path limits. The current release is v1.15.0.

Why the MCP Toolbox CVE matters for your business

MCP servers are the hands of your AI agents. Whatever the server can touch, a prompt-injected agent, or anyone who can reach the port, can touch too. This bug is a clean example: the tool did exactly what its parameters said, and nothing checked whether those parameters made sense.

What we would do today:

1. Find every copy. Check dev laptops, CI runners and the container someone stood up for a demo. Look for mcp-toolbox versions below 1.5.0.
2. Upgrade to current. Go to 1.15.0, not just 1.5.0, so you also get the symlink fix.
3. Set the allowlists. Put the buckets your agent needs in allowedBuckets. Point allowedLocalRoot at one scratch directory. Nothing else.
4. Take it off the network. An MCP server bound to 0.0.0.0 with no auth is an open API. Bind to localhost or put it behind auth.
5. Scope the service account. The GCS credentials should only write to buckets you own.

Patching fixes the bug. Least privilege fixes the next one.

Sources: CVE-2026-93328 record (Google Cloud CNA), googleapis/mcp-toolbox PR #3454, MCP Toolbox releases.