Skip to content
Critical Path Traversal Vulnerability in Google Cloud MCP Toolbox

Critical Path Traversal Vulnerability in Google Cloud MCP Toolbox

First seen 28 Oct 2026, 03:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 04:19 UTC
  • •CVE-2026-93328 allows unauthenticated file exfiltration and overwriting.
  • •Affected versions include Google Cloud MCP Toolbox for Databases 1.2.0 to 1.4.0.
  • •Patch released, but default settings remain vulnerable if not configured.

A critical vulnerability, CVE-2026-93328, was disclosed in Google Cloud's MCP Toolbox for Databases, affecting versions 1.2.0 to 1.4.0. The flaw allows unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite local files through crafted parameters. The vulnerability has a CVSS score of 9.3, indicating its critical nature. Google has released a patch, but the default settings of the tool still allow for potential exploitation if not properly configured. The vulnerability was first publicly demonstrated on October 27, 2026, just a day after its publication. Security professionals are urged to upgrade to versions beyond 1.4.0 and configure the necessary allowlists to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-26
CVE-2026-93328 published
Google disclosed a critical path traversal and missing authorization vulnerability in MCP Toolbox for Databases.
Sploitus
2026-10-27
First public PoC released
A proof-of-concept for CVE-2026-93328 was made publicly available, demonstrating the exploit's capabilities.
Sploitus
2026-10-28
Security advisory published
Strix.Ai reported on the vulnerability and urged users to check their systems for exposure.
Strix.Ai

More articles in this cluster (4)

Following this threat?

Track CNA Advisory and CVE-2026-93319 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (25)

1 / 4

Common questions

Which versions of MCP Toolbox are affected?
Versions 1.2.0 through 1.4.0 of Google Cloud MCP Toolbox for Databases are affected by CVE-2026-93328.
What is the CVSS score of this vulnerability?
CVE-2026-93328 has a CVSS score of 9.3, indicating it is critical.
What should I do if I'm using the affected versions?
Upgrade to a version beyond 1.4.0 and configure the allowlists to mitigate the risk of exploitation.