MCP Toolbox for Databases: path traversal and missing authorization in cloud-storage source (CVE-2026-93328), fix in 1.5.0
Published 02/11/2026 01:55
Timeline
2 events over 10 d
- 22/10/2026 16:28ConfirmedBSI CERT-Bund (WID)+10 d
- 02/11/2026 01:55Published on WatchtowerPro CISO
In short
CVE-2026-93328 is a critical flaw (CVSS 9.3) in the cloud-storage source of Google Cloud MCP Toolbox for Databases 1.2.0 through 1.4.0. An unauthenticated remote attacker could copy host files to external storage buckets and overwrite local files. Upgrade to 1.5.0 or later and configure the new allowedLocalRoots and allowedBuckets settings.
How bad is it
Critical. An attacker who can reach a vulnerable Toolbox server could copy its files to their own storage and overwrite files on it, without logging in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 4.0 from NVD, from the vendor, read 02/11/2026.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox), cloud-storage source, versions 1.2.0 through 1.4.0.
Fixed in
- 1.5 branch: 1.5.0
What to do now
- Find every MCP Toolbox deployment that uses a cloud-storage source and check its version.
- Upgrade to 1.5.0 or later. Read the release notes first, because the change is marked as breaking.
- After upgrading, explicitly set allowedLocalRoots and allowedBuckets to the narrowest paths and buckets needed. Reported behaviour is that the protection does nothing until allowedLocalRoots is configured.
- Until you can upgrade, remove the cloud-storage source or its upload and download tools from the configuration, and block network access to the server from untrusted clients. These interim measures reduce exposure but do not make a server safe.
- Review logs for unexpected storage tool calls, unfamiliar destination buckets and writes outside expected paths.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Google Cloud Platform (GKE containerd), at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [hoch] Google Cloud Platform (GKE containerd): Mehrere Schwachstellen CERT · [NEU] [hoch] Google Cloud Platform: Schwachstelle ermöglicht Codeausführung CERT · cR0w Community