Google Cloud Discloses Critical MCP Toolbox Vulnerability
CVE-2026-93328 in the MCP Toolbox AI connector has a CVSS 4.0 score of 9.3 and could let attackers steal or overwrite server files, according to dailysecu.com.
Google Cloud has registered CVE-2026-93328, a critical vulnerability in its MCP Toolbox, a Model Context Protocol tool for databases, according to dailysecu.com. The flaw carries a CVSS 4.0 severity score of 9.3.
The vulnerability affects versions from 1.2.0 up to but not including 1.5.0. It stems from insufficient file path validation and access permission checks in the feature that connects to Google Cloud Storage.
An attacker sending crafted requests could send server-stored files to an attacker-specified external cloud storage or overwrite existing files. Under certain conditions, unauthenticated remote attackers can exploit the vulnerability.
Google Cloud recommends updating to version 1.5.0 or later and explicitly restricting local directories and cloud storage accessible from the server. Administrators should also minimize the OS account and cloud access permissions used by the AI connector tool.
Quick answers
What is CVE-2026-93328?
It is a critical vulnerability in Google Cloud's MCP Toolbox with a CVSS 4.0 score of 9.3 that could let attackers steal or overwrite server files.
Which versions are affected?
Versions from 1.2.0 up to but not including 1.5.0.
How can I fix it?
Google Cloud recommends updating to version 1.5.0 or later and restricting local directories and cloud storage accessible from the server, while minimizing OS account and cloud access permissions used by the AI connector tool.