CVE-2026-93328

Google MCP Toolbox cloud-storage tools lack file and bucket boundaries

Google Cloud · MCP Toolbox for Databases cloud-storage source

First documented disclosure · Review checkpoint

Summary

Crafted tool parameters could move host files to an external bucket or overwrite local files.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources do not establish malicious exploitation or a Google Cloud customer breach.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Cloud-storage operations lacked enforced bucket and local-path authorization boundaries.

Conditions required

A reachable affected cloud-storage tool, with service permissions to access the relevant host files and bucket.

Potential impact

File disclosure or overwrite within the service's effective permissions.

Affected versions and configurations

1.2.0 through 1.4.0.

Fix and mitigation status

1.5.0 or later, with allowedLocalRoots and allowedBuckets configured.

Practical next steps

Upgrade, explicitly configure both allowlists, and restrict the service's OS and IAM permissions. Omitted lists allow all.

Operating lesson

Installing new authorization controls does not protect a deployment until those controls are configured.

Evidence and limits

June 16 public PR and dated review describe the missing security boundaries; October 26 is the CVE publication. The date does not imply a full exploit narrative was public in June.

Sources