PT-2026-123369

CVE-2026-93328

·

Published

2026-10-26

·

Updated

2026-10-26

Description by

CVSS 4.0
9.3
Critical
MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber
Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox versions 1.2.0 through 1.4.0
Description Path traversal and missing authorization in the cloud-storage source allow an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files. This is achieved through the use of crafted tool invocation parameters.
Recommendations Upgrade googleapis/mcp-toolbox to version 1.5.0 or later. Configure the allowedLocalRoots and allowedBuckets settings. Run the application as an unprivileged OS user with least-privilege IAM permissions.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
CWE-862: Missing Authorization
Related identifiers
CVE-2026-93328
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com