Which versions of MCP Toolbox are affected by CVE-2026-15829?

Google's MCP Toolbox for Databases (bigquery-forecast component) contains a SQL injection vulnerability allowing authenticated users to circumvent dataset access controls and read arbitrary BigQuery…

How to fix or mitigate CVE-2026-15829?

Within 24 hours: disable the bigquery-forecast tool in all production environments and conduct an audit of your MCP access logs to identify all client interactions with this tool. Within 7 days: implement interim security controls including restricting the BigQuery service account's IAM permissions to only essential datasets via role-based access controls, enabling comprehensive audit logging for BigQuery queries, and segmenting network access to MCP clients. Within 30 days: continue monitoring Google's advisory channels for patch availability; if no patch is released, conduct a forensic review of BigQuery query logs from the vulnerability discovery date onward to detect signs of exploitation, and evaluate alternative forecasting solutions.

MCP Toolbox CVE-2026-15829

Q: What is the CVSS score of CVE-2026-15829?

CVE-2026-15829 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46317 HIGH

SQL Injection (CWE-89)

2026-07-21 Google

GHSA-wvx3-gvxv-cmxc

SQLi Google Mcp Toolbox For Databases Googleapis Mcp Toolbox

8.6

CVSS 4.0 · Vendor: Google

Severity by source

Vendor (Google) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Authorized low-privilege client controls tool parameters (PR:L) over the network with low complexity; primary impact is unauthorized cross-dataset reads (C:H), with limited/uncertain integrity impact (I:L) and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Google).

CVSS VectorVendor: Google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 21, 2026 - 17:31 vuln.today

Analysis Generated

Jul 21, 2026 - 17:31 vuln.today

CVE Published

Jul 21, 2026 - 16:39 cve.org

HIGH 8.6

DescriptionCVE.org

A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox.

The tool accepts client-controlled parameters (data_col, timestamp_col, and id_cols) as plain strings and interpolates them unescaped via fmt.Sprintf directly into a generated AI.FORECAST table-valued SELECT statement. While MCP Toolbox utilizes an allowedDatasets mechanism to restrict queries, this defense only validates the history_data parameter; the final assembled query is executed without re-validation.

An attacker can break out of the string literal fields (such as timestamp_col) to inject a valid multi-statement or cross-dataset query block. This allows an unauthorized user to bypass the operator-configured allowedDatasets boundary and read arbitrary BigQuery tables.

AnalysisAI

SQL injection and security-boundary bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) lets a low-privileged MCP client abuse the prebuilt BigQuery forecasting tool (bigquery-forecast) to read arbitrary BigQuery tables. The tool interpolates client-supplied column parameters (data_col, timestamp_col, id_cols) unescaped into a generated AI.FORECAST SELECT statement, and the operator-configured allowedDatasets guard only validates the history_data parameter - not the final assembled query - so an attacker breaks out of a string literal to reach datasets that should be off-limits. There is no public exploit identified at time of analysis; risk derives from the injection primitive plus the confidentiality impact of cross-dataset reads.

Technical ContextAI

MCP Toolbox for Databases is a Google open-source server that exposes database operations to LLM/agent clients through the Model Context Protocol. The affected tool builds a BigQuery AI.FORECAST table-valued function query by concatenating user-controlled identifiers via fmt.Sprintf without escaping, which is the classic CWE-89 (improper neutralization of SQL elements) failure applied to identifier/string-literal fields. It is compounded by CWE-863 (incorrect authorization): the allowedDatasets control is a validation applied to one input (history_data) rather than to the effective query, so the authorization check and the executed statement diverge. The linked PR #3324 shows the remediation pattern - replacing NewStringParameter with NewStringParameterWithEscape ('single-quotes' escaping), swapping ValidColumnName/ContainsRune checks for stricter ValidColumnParam/ValidContributionMetricParam validators, and moving the allowedDatasets dry-run check so it validates the fully assembled query (dryRunJob.ReferencedTables) rather than a single raw parameter.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/googleapis/mcp-toolbox/pull/3324, which introduce quote-escaping for the column/metric parameters and, critically, move the allowedDatasets validation to a dry-run of the fully assembled query so referenced tables are re-checked before execution; upgrade to the first tagged release that includes this PR once published. As compensating controls until you can upgrade: disable or unregister the BigQuery forecasting tool (bigquery-forecast) from the toolset if it is not needed; do not treat allowedDatasets as a hard security boundary for this tool and instead enforce dataset isolation at the IAM/service-account layer by granting the MCP Toolbox service account read access only to the specific datasets it legitimately needs (accepting that this narrows what any tool can query); and restrict which clients/identities may reach the MCP endpoint. Each of these reduces functionality - removing the tool eliminates forecasting, and tightening IAM may break other tools that legitimately query broader datasets - so scope them to the forecasting workflow.