al-ice.ai

The Fix Shipped in June as a Feature; the CVE Landed Today at 9.3: Path Traversal in Google’s MCP Toolbox

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 26 October 2026 the National Vulnerability Database published CVE-2026-93328 (CVSS 4.0 9.3): path traversal and missing authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox), versions 1.2.0 through 1.4.0, allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The vector is maximally remote — network, low complexity, no privileges, no user interaction, high impact on confidentiality, integrity and availability. MCP Toolbox is the connector layer that lets AI agents query enterprise databases, so “crafted tool invocation parameters” means the exact input channel an agent drives on an attacker’s behalf. If you run a copy in the affected range, the agent’s database helper is also an unauthenticated file-exfiltration primitive.

The disclosure gap: fixed as a feature, CVEd four months later

The NVD record’s sole code reference is upstream pull request #3454, “restrict bucket and local path access”, which added allowedBuckets and allowedLocalRoot allow-lists — defaulting to allow-all — and was merged 18 June 2026 and released in v1.5.0 the same day, credited to reporter HE WEI. Read that again: the fix shipped four months ago framed as a feature, with no security advisory from the maintainer, and today’s CVE is the first public characterization of what it closed. The mirrored GitHub advisory (GHSA-2gc9-c85v-5vwr) is unreviewed, auto-imported from NVD today, with no package and no patched version listed — there is still no maintainer-authored advisory telling users which release to take. Our inference, labelled as such: the patched line is v1.5.0 and later (the same-day release containing the merge; current is v1.15.0, cut 23 October), so anything at or below 1.4.0 should be treated as exposed. This is the same silent-fix pattern we documented in Claude Agent SDK’s CVE-2026-96620, where the fix shipped 92 days before the CVE, and the OpenCode MCP OAuth RCE that shipped with no advisory at all — and it is the posture a scanner cannot see: no advisory, no alert, just a CVE number arriving months after the patch train left.

Why this one matters more than its siblings

This is the second MCP Toolbox cloud-connector flaw on this site after June’s CVE-2026-9739 DNS-rebinding issue, and the shape is worse in the dimension that counts for agents. DNS rebinding requires positioning the victim’s browser; this requires only reaching the Toolbox server and sending tool parameters — the normal, documented way an agent talks to it. An unauthenticated attacker who can invoke the cloud-storage tools can pull host files out to buckets they control and push content in over local files, which turns a read-path connector into a write-path foothold on the host running the agent’s data plane. Pair that with the month’s running theme — secrets sprawling through MCP configs, standing tokens harvested at scale — and the exposure composes: the connector holds the database credentials, and the connector itself accepted unauthenticated instructions about which bucket and which path.

If you operate Toolbox: inventory for any instance at 1.2.0–1.4.0 and upgrade past the June line (current v1.15.0); if you stayed on the affected range, set the allow-lists explicitly rather than relying on defaults, since the fix’s own defaults preserve the old permissive behavior for compatibility; and treat tool-invocation parameters to data connectors as untrusted input in your threat model, not as internal plumbing — every agent framework that forwards model-generated arguments into these tools inherits the flaw.

Our verification was read-only. The CVE description, CVSS 4.0 vector, affected versions, publication timestamp and CWE were read first-hand from the NVD API record; the advisory’s unreviewed status, NVD-import provenance and missing patched-version fields were read first-hand from the GHSA page; the fix title, allow-list mechanism, merge date, reporter credit and v1.5.0 same-day release were read first-hand from the upstream pull request page and the repository releases API. The v1.5.0-as-patched-line conclusion is our inference from the release timeline, not a vendor statement. We built, ran, contacted and probed nothing. Brave Search was used for discovery only.

Sources: