A critical advisory published Oct 26 covers the cloud-storage source in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox). Path traversal plus missing authorization lets an unauthenticated remote attacker use crafted tool-call parameters to exfiltrate host files to an external GCS bucket and overwrite arbitrary local files. Affected versions are 1.2.0 through 1.4.0.

The current release is 1.15.0 (Oct 23), so most up-to-date installs are clear. The risk is pinned or forgotten Toolbox servers, often deployed as a sidecar for an agent. Check: find Toolbox binaries and images in that range, especially any with a cloud-storage source configured or reachable from outside, and upgrade. Treat a Toolbox endpoint like any other unauthenticated API: keep it off the internet and put auth in front of it.