Is there a public PoC exploit available for CVE-2026-10277?

Yes, a public proof-of-concept exploit is available for CVE-2026-10277. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10277?

Yes, a patch is available for CVE-2026-10277. Update the affected software to the latest version immediately.

mcp-google-workspace CVE-2026-10277

Q: What is the CVSS score of CVE-2026-10277?

CVE-2026-10277 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33721 LOW

Improper Access Control (CWE-284)

2026-06-01 VulDB

GHSA-37j4-5858-49mq

Authentication Bypass Google Mcp Google Workspace

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 19:38 vuln.today

Analysis Generated

Jun 01, 2026 - 19:38 vuln.today

Severity Changed

Jun 01, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 19:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in j3k0 mcp-google-workspace up to 831790e7d5c2663325733d9f5579cc339a267c4c. This issue affects the function saveToDisk of the file src/tools/gmail.ts of the component MCP Gmail Tool. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The patch is named 89c091ecf8b9f9c7291d1af0b1966e271f86551c. It is suggested to install a patch to address this issue.

AnalysisAI

Path traversal via improper access control in mcp-google-workspace's MCP Gmail Tool (all pre-patch commits through 831790e) allows an authenticated low-privileged MCP client to write files to arbitrary filesystem locations by supplying crafted relative paths containing directory traversal sequences to the saveToDisk function. Publicly available exploit code exists (GitHub issue #19), though the attack requires an active MCP session (CVSS PR:L). No public exploitation has been confirmed by CISA KEV, but the MCP deployment context introduces prompt-injection as a realistic delivery vector - a malicious email or document processed by an AI assistant could trigger the vulnerable tool without direct human interaction beyond the initial session setup.

Technical ContextAI

mcp-google-workspace (CPE: cpe:2.3:a:j3k0:mcp-google-workspace:*:*:*:*:*:*:*:*) is a Model Context Protocol server that bridges Google Workspace services - Gmail, Calendar, and Drive - into AI assistant workflows such as Claude Desktop. The vulnerable code resides in src/tools/gmail.ts within the saveToDisk function, which is invoked by the gmail_get_attachment and gmail_bulk_save_attachments MCP tools when persisting email attachments to local disk. The function accepted caller-supplied file paths without any validation, a textbook CWE-284 (Improper Access Control) path traversal defect: a path such as '../../.ssh/authorized_keys' would resolve outside the intended attachments directory. The patch (commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c) introduces a resolveAttachmentPath helper in a new gmail-helpers.ts module that enforces a configurable base directory (GMAIL_ATTACHMENTS_DIR, defaulting to ~/.mcp-gsuite/attachments), rejects absolute paths, directory traversal sequences, NUL bytes, and symlinks that escape the base directory - all verified by an accompanying test suite.

RemediationAI

Apply the upstream fix by updating mcp-google-workspace to a version at or after commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c (https://github.com/j3k0/mcp-google-workspace/commit/89c091ecf8b9f9c7291d1af0b1966e271f86551c, PR #22); since no tagged release is available, operators should pull the latest main branch commit and verify the gmail-helpers.ts resolveAttachmentPath function is present. As a compensating control prior to patching, explicitly set the GMAIL_ATTACHMENTS_DIR environment variable to a dedicated, sandboxed directory with tight OS-level permissions, isolating any traversal attempts to an inconsequential path; note that this alone does not block the attack if the controlled directory itself contains sensitive content. Operators who do not require attachment-saving functionality should disable the gmail_get_attachment and gmail_bulk_save_attachments tools entirely, accepting the trade-off of losing that workflow. Running the MCP server process under a dedicated least-privilege OS account further constrains the blast radius by limiting which filesystem paths a successful traversal can reach. The patch also adds GMAIL_ALLOW_SENDING and GMAIL_ALLOW_DRAFTS flags (both disabled by default) to reduce the overall attack surface of the server.