Which versions of MCP Toolbox for Databases are affected by CVE-2026-93328?

Versions 1.2.0 through 1.4.0 of googleapis/mcp-toolbox carry the flaw, per the advisory, and v1.5.0 released on June 18, 2026 contains the fix. Anyone who has updated the Toolbox since that date is already past it. Deployments that pin an older tag are the ones still exposed, and upgrading is the action the advisory supports.

Does upgrading MCP Toolbox to v1.5.0 close the cloud-storage flaw by itself?

Upgrading brings in the allowedBuckets and allowedLocalRoots options, but the commit that added them records the default as allow all, so the limits only apply once an operator sets them. Configuring both on every cloud-storage source is part of the work, even though the advisory marks only versions below 1.5.0 as affected.

What can an attacker reach through the MCP Toolbox cloud-storage flaw?

An unauthenticated remote caller can make the server copy files from its host into Google Cloud Storage buckets outside the deployment, and can overwrite arbitrary files on the local filesystem, the advisory states. Both run through crafted tool invocation parameters, so files readable and writable by the Toolbox process are the exposure.

MEDVulnerability

Google MCP Toolbox: a storage tool copied host files out to any bucket

CVE-2026-93328 was published on October 26, 2026, four months after the change that fixed it shipped in MCP Toolbox v1.5.0.

October 26, 2026 · GitHub Advisory Database · Research by HE WEI（ギカク)

CVE-2026-93328

MEDVulnerability

Google's MCP Toolbox for Databases had a path traversal and missing authorization flaw in its cloud-storage source: an unauthenticated remote caller could copy host files to outside buckets and overwrite local files, CVE-2026-93328 says.

01What happened

CVE-2026-93328 was published for Google Cloud MCP Toolbox for Databases on October 26, 2026. HE WEI（ギカク) reported the flaw, according to the commit that fixed it, and that commit was merged in June 2026 as a feature rather than as a security fix, so the public record of the issue arrives months after the patch.

02How it works

The cloud-storage source took bucket names and local file paths straight from tool invocation parameters, with no allow-list and no authorization check. A caller could point a storage tool at a bucket outside the deployment and have the server copy host files into it, or walk a path back out of the intended directory and overwrite a local file. The fix adds allowedBuckets and allowedLocalRoots options, applied to the list, read, write, upload, download, copy, move and delete operations.

03Who is affected

Deployments running googleapis/mcp-toolbox 1.2.0 through 1.4.0 are the exposed ones, and the advisory describes the caller as unauthenticated and remote. Toolbox is Google's open-source MCP server for databases, written in Go and published under Apache-2.0.

04What to do

Update MCP Toolbox to v1.5.0 or later. Set allowedBuckets and allowedLocalRoots on every cloud-storage source after updating, because the commit that added those options records their default as allow all.

Questions people ask

Which versions of MCP Toolbox for Databases are affected by CVE-2026-93328?: Versions 1.2.0 through 1.4.0 of googleapis/mcp-toolbox carry the flaw, per the advisory, and v1.5.0 released on June 18, 2026 contains the fix. Anyone who has updated the Toolbox since that date is already past it. Deployments that pin an older tag are the ones still exposed, and upgrading is the action the advisory supports.
Does upgrading MCP Toolbox to v1.5.0 close the cloud-storage flaw by itself?: Upgrading brings in the allowedBuckets and allowedLocalRoots options, but the commit that added them records the default as allow all, so the limits only apply once an operator sets them. Configuring both on every cloud-storage source is part of the work, even though the advisory marks only versions below 1.5.0 as affected.
What can an attacker reach through the MCP Toolbox cloud-storage flaw?: An unauthenticated remote caller can make the server copy files from its host into Google Cloud Storage buckets outside the deployment, and can overwrite arbitrary files on the local filesystem, the advisory states. Both run through crafted tool invocation parameters, so files readable and writable by the Toolbox process are the exposure.

Sources 3 links, all fetched

1github.comGitHub Advisory
2github.comFix Pull Request
3github.comv1.5.0 Release Notes