CVE-2026-93328 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale . Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. .
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
Source: CNA advisory (CVE.org). NVD analysis pending.
Frequently Asked Questions
Uncovering a hidden BOLA in Appsmith's snapshot logic Strix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
Autonomous Pentesting AI agents that find and validate exploitable vulnerabilities like this one across your applications.
PR Reviews Pentest every pull request so vulnerable code is caught before it ships to production.
AI Penetration Testing How AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
CVE-2026-93319 A malicious external BuildKit frontend can send requests usi… 5.7
CVE-2026-93320 BuildKit may be tricked into performing file actions with sp… 6
CVE-2026-93321 A malicious frontend can submit an LLB definition that cause… 6.9
CVE-2026-93322 A malicious frontend can submit an LLB definition that cause… 6.9
CVE-2026-93323 The Dockerfile frontend loaded the Dockerfile and .dockerign… 6.8
CVE-2026-93326 A build step for a Git source, crafted in a specific way, ca… 6
CVE-2026-93330 Improper rule enforcement in the PAM Active Directory provid… 4.3
CVE-2026-93331 A vulnerability was identified in GPAC 26.08-DEV. This vulne… 7.3
CVE-2026-93332 Improper access control in the partial connection API in Dev… 5.4
CVE-2026-93336 Missing authorization in the unit resources download route i… 7.1
CVE-2026-93337 NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contain… 7.8
CVE-2026-93338 Grandstream GWN7660ELR before firmware version 1.0.27.6 cont… 5.3
Are you affected by CVE-2026-93328 ?
Run a free Strix scan to check your systems for this vulnerability.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
