CVE-2026-14538
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Google mcp-toolbox versions 0.16.1 through 1.4.0 have an improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. An authenticated attacker can extract structural DDL schemas for excluded datasets via INFORMATION_SCHEMA and access downstream federated row data via EXTERNAL_QUERY connections.
Risk Assessment
An attacker can gain unauthorized access to excluded BigQuery datasets, including schemas and row data, compromising data confidentiality and integrity.
Recommendation
Upgrade Google mcp-toolbox to a version later than 1.4.0, which includes a fix to correct the dataset validation logic.
Other vulnerabilities in Google mcp-toolbox
See all- CVE-2026-14537Critical
In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.
- CVE-2026-14541High
In Google mcp-toolbox version 1.4.0, when Google OAuth is configured with mcpEnabled: true without explicit audience or clientId, opaque token audience validation is skipped, allowing acceptance of any valid Google OAuth token from other applications.
- CVE-2026-14540Medium
In Google mcp-toolbox versions 0.3.0 through 1.4.0, an SSRF vulnerability exists in HTTP source and tool components due to missing restrictive CheckRedirect policy and target IP validation, allowing requests to be redirected to internal or arbitrary external endpoints.
- CVE-2026-14539High
Google mcp-toolbox versions up to 1.4.0 have an allocation of resources without limits vulnerability in the HTTP handler component. The /mcp endpoint reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without defensive constraints. An unauthenticated attacker can submit a single massive HTTP request, linearly consuming host memory until the process is terminated by an OOM error.
Original NVD description (English source)
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.