External risk intelligence

MCP Toolbox Path Traversal and Missing Authorization

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-93328

The vulnerability exists in a Model Context Protocol (MCP) tool, which is typically used as a bridge between LLMs and local or cloud services. While these integrations can be exposed via network-accessible services, they are not inherently public-facing by design and often function as internal tooling or developer utilities within a broader architecture, making public internet exposure a possibility rather than a standard deployment pattern.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability in the Google Cloud MCP Toolbox for Databases could allow unauthorized access to sensitive host files, enabling attackers to exfiltrate data or overwrite local files. This issue impacts the cloud-storage source component of the tool.

Unauthenticated remote attackers can access files.
It affects a tool that bridges databases and cloud storage.
Confirm relevance and exposure of this database tool.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could reach this vulnerability by invoking a vulnerable cloud-storage feature within the tool. This could allow them to read sensitive host files and send them to an external storage location, or to overwrite local files on the host.

No authentication required.
Crafted tool invocation.
Exfiltrate data, overwrite files.

Live Threat

Current exploitation, exposure, and threat context

The cloud-storage source in the Google Cloud MCP Toolbox for Databases could allow an unauthenticated remote attacker to access and exfiltrate host files to external Google Cloud Storage buckets, or overwrite arbitrary local files, by providing specially crafted parameters during tool invocation.

Host files could be exfiltrated.
Crafted parameters could overwrite local files.
Sensitive data exposure and system compromise are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The criticality of this path traversal and missing authorization vulnerability in the Google Cloud MCP Toolbox for Databases necessitates immediate attention from teams responsible for cloud infrastructure, platform management, and application development. The first step is to identify all instances of this tool, determine their network exposure and business criticality, and then assign ownership for remediation.

Cloud platform and app owners should act.
Verify tool instances and network exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google Cloud MCP Toolbox for Databases?

It is a specialized collection of tools designed to facilitate interactions between Large Language Models and database systems. It uses the Model Context Protocol to bridge AI models with data sources, allowing for streamlined data queries, management, and cloud storage operations within development and infrastructure workflows.

What do the CWE-22 and CWE-862 weaknesses mean for CVE-2026-93328?

These codes identify two fundamental flaws: Path Traversal (CWE-22) and Missing Authorization (CWE-862). Together, they mean the software fails to verify if a user has permission to perform an action and allows them to navigate outside intended folders to access sensitive files on the underlying host system.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted tool invocation parameters to the cloud-storage component. Importantly, this bug is not triggered by standard, legitimate database queries or general usage; it specifically requires submitting malicious input designed to exploit the lack of file path validation.

Is my instance of MCP Toolbox at risk?

According to Halo Surface Signal, this tool acts as a bridge for LLMs and is often used for internal utilities or developer tasks. While not always public-facing by design, any instance reachable via a network-accessible service carries a higher risk. You should assess if your deployment is exposed to the internet or reachable by untrusted parties.

What are the first steps to address this CVE?

Begin by creating a comprehensive inventory of all MCP Toolbox instances running in your environment. Once identified, evaluate the network accessibility for each instance. Prioritize securing or isolating any tools that have network connectivity, and coordinate with your development or platform teams to plan and apply the necessary updates.

References

github.com/googleapis/mcp-toolbox/pull/3454

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.