What happened
Google published CVE-2026-15829 (CVSS 8.6) on 2026-07-21 disclosing a SQL injection and security boundary bypass in its official MCP Toolbox for Databases, which exposes database tools to LLM agents via the Model Context Protocol.
Why it matters
MCP Toolbox for Databases is Google's own officially maintained MCP server bridging LLM agents to enterprise databases including BigQuery; a bypass of its dataset access-control boundary lets any agent or user with access to the forecasting tool exfiltrate data from BigQuery tables the operator explicitly intended to keep off-limits, undermining the core access-control guarantee enterprises rely on when exposing data tools to AI agents.
Attack vector
The prebuilt BigQuery forecasting MCP tool interpolates client-controlled parameters (data_col, timestamp_col, id_cols) unescaped via fmt.Sprintf into a generated AI.FORECAST SQL statement. The operator-configured `allowedDatasets` boundary only validates the history_data parameter, so an attacker can break out of a string-literal field to inject a multi-statement or cross-dataset query, bypassing the dataset access boundary and reading arbitrary BigQuery tables.
Affected systems
googleapis/mcp-toolbox (Google MCP Toolbox for Databases), bigquery-forecast prebuilt tool, v1.4.0
Mitigation
Update to the patched version of googleapis/mcp-toolbox per the vendor fix in PR #3324; audit any deployed bigquery-forecast tool configurations for unescaped parameter interpolation.