Google MCP Toolbox CVE-2026-93328

The cloud-storage source must be configured and enabled in a MCP Toolbox for Databases instance running 1.2.0 through 1.4.0, and the instance's tools must be invocable by the attacker. The decisive condition is the pre-fix default: per PR #3454, allowedBuckets and allowedLocalRoots did not exist, so 'if omitted, all buckets are allowed' and 'if omitted, all paths are allowed' - meaning any out-of-the-box deployment that did not (and could not) restrict buckets/local roots is exploitable via DownloadObject/GetObjectMetadata/UploadObject destination, source and bucket parameters. Limiting factors that reduce realistic risk: the toolbox endpoint and its cloud-storage source must be network-reachable to an unauthenticated caller (MCP Toolbox is frequently deployed internally or bound locally), and the host service account must hold GCS permissions for the exfiltration-target buckets.

All severity signals point the same direction: the input CVSS 4.0 base score is 9.3 (critical) with AV:N/AC:L/AT:N/PR:N/UI:N and high vulnerable-system confidentiality, integrity and availability (VC:H/VI:H/VA:H), and the vuln.today Decision label is act_now - so this should be treated as an urgent, prioritize-now issue, not a high-CVSS-but-low-real-risk item. The weakness class is strong corroboration: CWE-862 (Missing Authorization) plus path traversal means no auth check gates the cloud-storage tool parameters, matching the PR:N claim. However, two signals are simply absent rather than reassuring: no EPSS probability was provided and the CVE is not listed in CISA KEV, so there is no data indicating widespread or active exploitation yet - low/no EPSS and no KEV alongside an act_now label suggests the urgency is driven by intrinsic severity and ease of exploitation rather than observed in-the-wild activity. One important real-world caveat the raw AV:N does not capture: MCP Toolbox for Databases is typically deployed as an internal/agent-facing service, so 'unauthenticated remote' presupposes the endpoint and its cloud-storage source are actually network-reachable to the attacker; where the toolbox is bound locally or behind an authenticating gateway, practical reach is narrower than the vector implies - verify exposure in your deployment.

An attacker able to reach a Google Cloud MCP Toolbox for Databases instance (v1.2.0-1.4.0) with the cloud-storage source enabled sends a crafted tool invocation specifying a traversal path or arbitrary bucket. Because no authorization or path/bucket allow-list is enforced by default, the attacker downloads sensitive host files (e.g. config, keys) out to an external Google Cloud Storage bucket they control, and/or writes to an arbitrary local path to overwrite files on the host. The low attack complexity (AC:L) and lack of required privileges/interaction make the request straightforward once the endpoint is reachable; no public exploit code was identified in the provided data.