Path Traversal and Authorization Bypass in Google Cloud MCP Toolbox for Databases

CVE-2026-93328

What is CVE-2026-93328?

The Google Cloud MCP Toolbox for Databases is susceptible to a path traversal vulnerability combined with missing authorization checks. This flaw enables an unauthenticated remote attacker to exploit crafted tool invocation parameters, potentially leading to unauthorized access to host files. By leveraging this vulnerability, attackers can exfiltrate sensitive files to external Google Cloud Storage buckets or even overwrite local files, posing significant risks to data integrity and confidentiality.

References