CVE-2026-14538

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/googleapis/mcp-toolbox/pull/3452	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:mcp_toolbox_for_databases:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de autorización indebida y omisión de límites de seguridad en el componente de herramienta bigquery-execute-sql de las versiones 0.16.1 a 1.4.0 de Google mcp-toolbox permite a un atacante autenticado omitir las comprobaciones de validación de allowedDatasets. La caja de herramientas se basa en la API de ejecución en seco de BigQuery para aplicar las restricciones de conjuntos de datos, pero debido a un fallo lógico de fail-open, omite la validación cuando la API devuelve una matriz vacía para construcciones especializadas. Esto permite al atacante extraer esquemas DDL estructurales para conjuntos de datos explícitamente excluidos a través de INFORMATION_SCHEMA, y acceder a datos de fila federados posteriores a través de conexiones EXTERNAL_QUERY.

Information

Published : 2026-07-31 02:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-14538

Mitre link : CVE-2026-14538

CVE.ORG link : CVE-2026-14538

JSON object : View

Products Affected

google

mcp_toolbox_for_databases

CWE

CWE-285

Improper Authorization

CWE-863

Incorrect Authorization

{"id": "CVE-2026-14538", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14538", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T16:09:10.915078Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@google.com", "affectedData": [{"vendor": "Google", "product": "mcp-toolbox", "versions": [{"status": "affected", "version": "0.16.1", "versionType": "semver", "lessThanOrEqual": "1.4.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T02:16:28.757", "references": [{"url": "https://github.com/googleapis/mcp-toolbox/pull/3452", "tags": ["Issue Tracking", "Patch"], "source": "cve-coordination@google.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n indebida y omisi\u00f3n de l\u00edmites de seguridad en el componente de herramienta bigquery-execute-sql de las versiones 0.16.1 a 1.4.0 de Google mcp-toolbox permite a un atacante autenticado omitir las comprobaciones de validaci\u00f3n de allowedDatasets. La caja de herramientas se basa en la API de ejecuci\u00f3n en seco de BigQuery para aplicar las restricciones de conjuntos de datos, pero debido a un fallo l\u00f3gico de fail-open, omite la validaci\u00f3n cuando la API devuelve una matriz vac\u00eda para construcciones especializadas. Esto permite al atacante extraer esquemas DDL estructurales para conjuntos de datos expl\u00edcitamente excluidos a trav\u00e9s de INFORMATION_SCHEMA, y acceder a datos de fila federados posteriores a trav\u00e9s de conexiones EXTERNAL_QUERY."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:mcp_toolbox_for_databases:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9428C3B0-6787-456B-B85D-F4D90CE21073", "versionEndIncluding": "1.4.0", "versionStartIncluding": "0.16.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve-coordination@google.com"}