Auth bypass in Google Mcp-Toolbox
CVE-2026-14538
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.
EPSS: 0.002 (8.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Google Mcp-toolbox — versions 0.16.1
- Google Mcp_toolbox_for_databases
Weakness classification (CWE)
References
- cve-coordination@google.com (Patch, Issue Tracking)
Frequently asked questions
- What is CVE-2026-14538?
- CVE-2026-14538 is a high-severity vulnerability in Google Mcp-Toolbox, classified under Improper Authorization. CVSS score: 7.7/10. Published 2026-07-31.
- How severe is CVE-2026-14538?
- High severity. CVSS v3 base score is 7.7 out of 10.