Skip to content
OpenAdvisories

Product · Google

MCP Toolbox for Databases (googleapis/mcp-toolbox)

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2026-15829

    SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

    A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. The tool accepts client-controlled parameters (data_col, timestamp_col, and id_cols) …

    Google MCP Toolbox for Databases (googleapis/mcp-toolbox)
  • High 8.6
    CVE-2026-11719

    MCP Toolbox for Databases: authenticated authorization bypass

    An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 protocol version handler correctly enforces per-tool restrictions defined by scopesRe…

    Google MCP Toolbox for Databases (googleapis/mcp-toolbox) github.com/googleapis/mcp-toolbox Go