Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
④ 구글 MCP Toolbox 1.2~1.4 파일 유출 취약점, 1.5.0+로 https://www.cve.org/CVERecord?id=CVE-2026-93328 ⑤ PFN PLaMo 3.1 Prime, Deep Research 탑재 (성능은 회사 발표) https://www.preferred.jp/ja/news/pr20261027 https://t.co/ULEbH4cqhy
MCP Toolbox for DatabasesのCVE-2026-93328（CVSS 4.0で9.3）は、1.2.0〜1.4.0のcloud-storageが対象。1.5.0以降に上げ、許可リストも書く。 https://www.tetoran.com/mcp-toolbox-cve-2026-93328/ #脆弱性 #MCP
🚨 Si usas MCP Toolbox for Databases de Google con la fuente cloud-storage, revisa tu versión: CVE-2026-93328, crítica (CVSS 9.3). Un atacante sin autenticar podía sacar archivos de tu servidor a buckets externos y sobrescribir archivos locales. Afecta de la 1.2.0 a la 1.4.x 👇 https://t.co/lNDHrhfVwG
④ Google MCP Toolbox 1.2–1.4 file-leak flaw: upgrade to 1.5.0+ https://www.cve.org/CVERecord?id=CVE-2026-93328 ⑤ PFN's PLaMo 3.1 Prime adds Deep Research (figures are company claims) https://www.preferred.jp/ja/news/pr20261027 https://t.co/HZshJ9ZrR3
Google MCP Toolbox for Databases CVE-2026-93328: CVSS 9.3 path traversal and missing authorization in the cloud-storage source. An unauthenticated attacker can send crafted tool parameters to copy host files to external buckets and overwrite local files. Affects 1.2.0 to 1.4.0. VulnTracker recommends upgrading to 1.5.0 and setting allowedBuckets and allowedLocalRoot. Details: http://vulntracker.io/cves/CVE-2026-93328 #MCP #CVE #InfoSec
🚨 Running Google's MCP Toolbox for Databases? An unauthenticated attacker could copy your host files to their own cloud bucket (CVE-2026-93328) Missing authorization + path traversal in the cloud-storage source: crafted tool invocation parameters can exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files. CVSS 4.0: 9.3 (CNA, Google Cloud). 📦 Affected: googleapis/mcp-toolbox 1.2.0 through 1.4.0 🛡️ Fix: upgrade to 1.5.0+, then set allowedLocalRoots and allowedBuckets ✅ Also: run it as an unprivileged OS user with least-privilege IAM · Known exploited: not confirmed 🔗 https://www.cve.org/CVERecord?id=CVE-2026-93328 #CyberSecurity #CVE #MCP
Advisory oficial (CVE-2026-93328 / GHSA-2gc9-c85v-5vwr): https://github.com/advisories/GHSA-2gc9-c85v-5vwr El fix en el repo de Google: https://github.com/googleapis/mcp-toolbox/pull/3454