What happened
The cloud-storage source of Google's MCP Toolbox for Databases resolves tool-invocation paths without adequate traversal confinement or authorization (CWE-22 / CWE-862). The GitHub Advisory Database (GHSA-2gc9-c85v-5vwr) rated it CRITICAL (CVSS 9.3), published 2026-10-26; an unauthenticated remote attacker can exfiltrate host files to an external GCS bucket and overwrite arbitrary local files.
Why it matters
This is an agent-reachable, unauthenticated file read/write on the host running a Google-sanctioned MCP database tool server. Because an LLM agent can invoke these tools, a prompt-injection or direct network caller can read the host's secrets/env/credentials and write arbitrary local files (e.g. config or cron) — a direct foothold into the MCP host.
Attack vector
An attacker calls the MCP cloud-storage tool with crafted paths that traverse outside the intended directory while the tool lacks an authorization check, so it copies host files to an attacker-controlled GCS bucket and can overwrite arbitrary local files on the host running the MCP server.
Affected systems
googleapis/mcp-toolbox (Google Cloud MCP Toolbox for Databases) versions 1.2.0 through <1.5.0; cloud-storage source component.
Mitigation
Upgrade to googleapis/mcp-toolbox 1.5.0 or later (PR #3454).