Critical flaw in Google's MCP Toolbox let attackers read and overwrite server files

Google Cloud has published a critical vulnerability in MCP Toolbox for Databases, its open-source server that lets AI agents, IDEs and applications query enterprise databases through the Model Context Protocol (MCP). Tracked as CVE-2026-93328 and made public on October 26, 2026, the flaw scores 9.3 out of 10 under CVSS 4.0.

What the flaw allows

The problem sits in the toolbox's Cloud Storage source, the component that moves files between the host server and Google Cloud Storage buckets. According to the CVE record, a combination of path traversal and missing authorization checks lets an unauthenticated remote attacker send crafted tool parameters to read files on the host, copy them to an external bucket, or overwrite local files with content pulled from a bucket.

The attack works over the network, needs no privileges and no user interaction, which explains the high score. Its reach depends on the permissions the toolbox already holds: the Linux account it runs under and the bucket access of its Google Cloud service account. LinuxSecurity notes that the reported impact is reading or replacing files; turning this into code execution would be a further step that the disclosure does not demonstrate.

Affected versions and fixes

Versions 1.2.0 through 1.4.0 are affected, and the record lists 1.5.0 as the fixed release. LinuxSecurity reports that 1.5.0 shipped on June 18 with two new allowlist settings, which means the public CVE arrived months after the patch. The record credits a researcher identified as He Wei with the report.

Beyond upgrading, Google's recommended hardening is to set allowedLocalRoots to confine the folders the server can touch, set allowedBuckets to limit which buckets it can use, and run the service as an unprivileged user with narrow IAM roles. LinuxSecurity adds that empty allowlists leave access unrestricted, and advises requiring authentication and enabling Cloud Storage audit logs.

Why it matters for AI agents

MCP servers act on behalf of AI applications using their own credentials. That creates a confused-deputy risk: a user without access to a file could ask an agent to fetch it through the toolbox. LinuxSecurity argues that MCP authorization should check each action against the specific user, file and destination, not only whether a tool may be called.

As of October 27, no attacks exploiting the flaw had been reported, and it was absent from CISA's Known Exploited Vulnerabilities catalog. NVD analysis was still pending.