SQL Injection in Google Mcp Toolbox For Databases (Googleapis/mcp-toolbox)
CVE-2026-15829
A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox. The tool accepts client-controlled parameters (data_col, timesta…
Vulnerability class: SQL Injection
Affected products
- Google Mcp Toolbox For Databases (Googleapis/mcp-toolbox) — versions 0.13.0