Zero Radar
← feed
CriticalVulnerabilityCVE-2026-93328updated 26 Oct 2026, 17:57 UTC

Google Cloud MCP Toolbox lets outsiders read and overwrite server files

Someone on the internet with no login could trick the toolbox into copying files off your server into an outside cloud storage bucket, or overwriting files on your server. Anyone running it could have their files stolen or changed.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login needed, only network access
  2. 2Crafted tool requestPath traversal in invocation parameters
  3. 3Toolbox cloud-storage sourceMissing authorization check
  4. 4Host files read or overwrittenArbitrary local file access
  5. 5Files sent to external bucketExfiltration to Cloud Storage
  6. ResultAttacker steals or overwrites server files

What happened

Path traversal and missing authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (versions 1.2.0 through 1.4.0) let an unauthenticated remote attacker send crafted tool invocation parameters to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files.

Why it is dangerous: An attacker can steal sensitive local files, such as credentials or configuration, and overwrite arbitrary files on the host, potentially taking control of the system. Anyone exposing a vulnerable toolbox to a network is at risk.

Are you affected?

You are affected if you run Google Cloud MCP Toolbox for Databases versions 1.2.0 through 1.4.0 with the cloud-storage source enabled.

Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox), versions 1.2.0 through 1.4.0, cloud-storage source.

What to do

  1. Check whether you run MCP Toolbox versions 1.2.0 through 1.4.0 and whether the cloud-storage source is enabled
  2. Disable the cloud-storage source or restrict network access to the toolbox until a fix is applied
  3. Update to a fixed version as soon as one is released (check the GitHub advisory GHSA-2gc9-c85v-5vwr for the patched release)
  4. Review logs and cloud storage buckets for unexpected uploads or file changes

Timeline

  1. 26 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 15:21 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 17:57 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-93328 · GHSA-2gc9-c85v-5vwr
CVSS
9.3 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 15:16 UTC
On Zero Radar
26 Oct 2026, 15:21 UTC (5 min after disclosure)
Last change
26 Oct 2026, 17:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Cloud MCP Toolbox lets outsiders read and overwrite server files · Zero Radar