He Wei

Path traversal and missing authorization in the cloud-storage source allow an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files. This is achieved through the use of crafted tool invocation parameters.

A time-of-check time-of-use (toctou) race condition exists, which allows an authorized attacker to elevate privileges locally. A TOCTOU race condition occurs when a program checks the state of a resource and then acts upon that resource, but the state changes between the check and the use.

Starting the BuildKit daemon with the `--cdi-disabled` flag can cause a daemon panic when builds attempt to utilize Container Device Interface (CDI) devices. CDI is a specification that allows containers to access specialized hardware devices. This condition can be triggered either accidentally or maliciously.

An unauthenticated attacker who controls a registry or OCI-layout blob source can provide blob contents that do not match the claimed digest. This allows a snapshot to be cached under the incorrect digest and subsequently reused by a later victim build, which compromises the integrity of the build-input.

An out-of-bounds read occurs due to insufficient bounds checking, which may allow an application to cause a denial-of-service. An out-of-bounds read is a condition where a program reads data past the end or before the beginning of the intended buffer.

An authentication bypass and audience confusion issue exists in the Google OAuth provider component. When a Google authService is initialized with `mcpEnabled`: true but lacks an explicitly defined audience or `clientId`, the ValidateMCPAuth pipeline for opaque tokens skips audience validation. This allows the toolbox to accept any valid Google OAuth access token, including those created for unrelated ecosystem applications, which may grant unauthorized clients access to protected tools and data backends.

Incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature. This occurs when tool invocation requests are sent through legacy HTTP endpoints while the `--enable-api` flag is active.

An improper authorization and security-boundary bypass exists in the bigquery-execute-sql tool component. The system uses the BigQuery dry-run API to enforce dataset restrictions; however, a fail-open logic flaw occurs when the API returns an empty array for specialized constructs, allowing authenticated attackers to bypass `allowedDatasets` validation checks. This enables the extraction of structural DDL (Data Definition Language) schemas for excluded datasets through INFORMATION SCHEMA and provides access to downstream federated row data via EXTERNAL QUERY connections.

A resource allocation issue in the HTTP handler component allows an unauthenticated attacker to cause a denial of service (DoS). The '/mcp' endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop `io.ReadAll()` without applying defensive constraints like `http.MaxBytesReader` or pre-read Content-Length enforcement. An attacker can consume available host memory by submitting a single, massive HTTP request body until the process is terminated by an Out-Of-Memory (OOM) error, which occurs when the system cannot allocate more memory to the process.

An incorrect authorization issue allows an organization administrator to target site administrator accounts within the same organization using the administrative email functionality. The system fails to exclude accounts with the site administrator role from recipient queries, enabling an organization administrator to perform privileged account-management actions, such as initiating a password reset workflow, against higher-privileged accounts. Successful exploitation can lead to account takeover, privilege escalation, and full compromise of the instance's confidentiality, integrity, and availability. The attacker must be authenticated as an organization administrator in the same organization as the target site administrator.