{"id":"CVE-2026-93328","published":"2026-10-26T15:16:45.813","lastModified":"2026-10-26T17:17:31.020","description":"Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-22","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/googleapis/mcp-toolbox/pull/3454","tags":[]}],"exploitRefs":[{"url":"https://github.com/googleapis/mcp-toolbox/pull/3454","tags":[]}],"hasPoc":true,"ai":null}