Google mcp-toolbox CVE-2026-14538

Q: What is the CVSS score of CVE-2026-14538?

CVE-2026-14538 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51372 MEDIUM

Improper Authorization (CWE-285)

2026-07-31 Google

GHSA-24pp-m59v-92j8

Authentication Bypass Google Mcp Toolbox

5.7

CVSS 4.0 · Vendor: Google

Severity by source

Vendor (Google) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable, low-complexity bypass requiring authenticated (low-privilege) access; scope changes to federated external systems justify S:C with high confidentiality impact and no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Google).

CVSS VectorVendor: Google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 31, 2026 - 02:14 vuln.today

Analysis Generated

Jul 31, 2026 - 02:14 vuln.today

DescriptionCVE.org

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.

AnalysisAI

Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.

Technical ContextAI

Google mcp-toolbox is an MCP (Model Context Protocol) server that exposes BigQuery as a tool for LLM agents. The bigquery-execute-sql component enforces dataset-level access controls via an allowedDatasets allowlist, validated by parsing tables from a BigQuery dry-run API response. The root cause (CWE-285: Improper Authorization) is a fail-open conditional in bigqueryexecutesql.go: the restriction check was gated on if len(tableIDSet) > 0, meaning queries that cause the dry-run to return zero referenced tables - specifically INFORMATION_SCHEMA pseudo-views and EXTERNAL_QUERY() federated table functions - bypassed the enforcement path entirely. INFORMATION_SCHEMA is a virtual BigQuery construct that exposes DDL metadata (table definitions, columns, views, routines) without appearing in the dry-run table list. EXTERNAL_QUERY() is a BigQuery function for federated queries against Cloud Spanner, Cloud SQL, and other sources, and similarly produces no tableIDSet entries. Affected CPE: cpe:2.3:a:google:mcp-toolbox:*:*:*:*:*:*:*:* (versions 0.16.1 through 1.4.0).

RemediationAI

The upstream fix is available as GitHub PR #3452 at https://github.com/googleapis/mcp-toolbox/pull/3452; operators should upgrade to a released version that incorporates this patch once tagged - a specific fix version is not confirmed from available references ('Upstream fix available (PR/commit); released patched version not independently confirmed'). The fix enforces two explicit controls: it blocks EXTERNAL_QUERY entirely when dataset restrictions are in place, and it restricts INFORMATION_SCHEMA queries to a whitelist of dataset-level views while requiring a dataset prefix in the query path. As a compensating control prior to patching, operators can restrict which SQL constructs are permitted at the network or application gateway layer by blocking queries containing the literals EXTERNAL_QUERY and INFORMATION_SCHEMA before they reach the toolbox. The trade-off is that this breaks legitimate use of these BigQuery features. Alternatively, remove or restrict the allowedDatasets configuration if it is being relied upon for security isolation - the fail-open means it provides no enforcement for the affected constructs in unpatched versions.