🚨 HIGH - BigQuery forecast tool SQL injection + allowedDatasets bypass (CVE-2026-15829) A SQL injection and authorization boundary bypass vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) within googleapis/mcp-toolbox, where client-controlled parameters are interpolated into an AI.FORECAST query without proper escaping. The root cause is improper input validation/escaping combined with flawed authorization enforcement, as the allowedDatasets restriction validates only one parameter while the final assembled query is left unvalidated. An attacker can exploit this by supplying crafted parameters to inject multi-statement or cross-dataset SQL, bypassing allowedDatasets and executing queries against unauthorized datasets without needing elevated privileges beyond access to the tool endpoint. Impact includes unauthorized reads of arbitrary BigQuery tables (data exposure/exfiltration) and potential broader query abuse depending on the connected service account permissions. 👉 Affected: MCP Toolbox for Databases (googleapis/mcp-toolbox) bigquery-forecast (version range not specified) | Upgrade to No fix yet — treat as suspicious
Post summary
The post announces a new SQL injection and authorization bypass vulnerability in the BigQuery forecasting tool, enabling unauthorized reads of BigQuery tables. No patch is available and no exploit or active exploitation is reported.