---
title: Google's MCP Toolbox for Databases 1.2.0-1.4.0: CVE-2026-93328 lets an unauthenticated caller copy host files to an outside Cloud Storage bucket and overwrite local files | ctxsec
url: https://ctxsec.com/items/google-mcp-toolbox-cve-2026-93328-cloud-storage-file-exfil
description: ""
status: "advisory (GitHub Advisory Database GHSA-2gc9-c85v-5vwr, critical, published Oct 26); no exploitation reported"
published: 2026-10-26
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/google-mcp-toolbox-cve-2026-93328-cloud-storage-file-exfil.md)

advisory (GitHub Advisory Database GHSA-2gc9-c85v-5vwr, critical, published Oct 26); no exploitation reported

2026-10-26

### Google's MCP Toolbox for Databases 1.2.0-1.4.0: CVE-2026-93328 lets an unauthenticated caller copy host files to an outside Cloud Storage bucket and overwrite local files

A critical advisory published Oct 26 covers the **cloud-storage source** in Google's MCP Toolbox for Databases (`googleapis/mcp-toolbox`). Path traversal plus missing authorization lets an **unauthenticated remote attacker** use crafted tool-call parameters to **exfiltrate host files to an external GCS bucket** and **overwrite arbitrary local files**. Affected versions are **1.2.0 through 1.4.0**.

The current release is 1.15.0 (Oct 23), so most up-to-date installs are clear. The risk is pinned or forgotten Toolbox servers, often deployed as a sidecar for an agent. **Check:** find Toolbox binaries and images in that range, especially any with a `cloud-storage` source configured or reachable from outside, and upgrade. Treat a Toolbox endpoint like any other unauthenticated API: keep it off the internet and put auth in front of it.

Sources: [GitHub Advisory Database: GHSA-2gc9-c85v-5vwr (CVE-2026-93328)](https://github.com/advisories/GHSA-2gc9-c85v-5vwr) · [CVE record: CVE-2026-93328](https://www.cve.org/CVERecord?id=CVE-2026-93328) · [googleapis/mcp-toolbox releases](https://github.com/googleapis/mcp-toolbox/releases)