Is CVE-2026-14538 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14538 being exploited in the wild.

How severe is CVE-2026-14538?

Informational severity, with a CVSS score of 5.7, published 31 July 2026.

Which products and versions are affected?

Google MCP Toolbox 0.16.1 through 1.4.0.

Is there a fix for CVE-2026-14538?

A patch was published on 2026-06-18: Fix merged in GitHub pull request #3452 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14538 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14538?

Check whether you run Google MCP Toolbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14538: Google mcp-toolbox auth bypass in bigquery-execute-sql

CVE-2026-14538 · Severity: info · CVSS 5.7 · Published 2026-07-31

A security flaw in Google's mcp-toolbox, a set of tools for Model Context Protocol integrations, allows users to bypass data access restrictions in BigQuery. An attacker with valid credentials could view the structure of databases they are supposed to be blocked from and potentially access data in external connected systems. This could lead to unauthorized exposure of sensitive data schemas and downstream information.

Technologies: Google MCP Toolbox. Vendors: Google.

Quick answers

Is CVE-2026-14538 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14538 being exploited in the wild.
How severe is CVE-2026-14538?: Informational severity, with a CVSS score of 5.7, published 31 July 2026.
Which products and versions are affected?: Google MCP Toolbox 0.16.1 through 1.4.0.
Is there a fix for CVE-2026-14538?: A patch was published on 2026-06-18: Fix merged in GitHub pull request #3452 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14538 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14538?: Check whether you run Google MCP Toolbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285/CWE-863) exists in the bigquery-execute-sql tool within Google mcp-toolbox versions 0.16.1 through 1.4.0. The component relies on the BigQuery dry-run API to enforce 'allowedDatasets' restrictions; however, a fail-open logic flaw occurs when the API returns an empty array for specific SQL constructs. An authenticated attacker can exploit this to extract DDL schemas for excluded datasets via INFORMATION_SCHEMA or access federated row data using EXTERNAL_QUERY connections. The issue is addressed in pull request #3452 by implementing a mandatory table parser and restricting specific metadata views.

Affected products

Google mcp-toolbox 0.16.1 through 1.4.0

Timeline

2026-06-18: patched: Fix merged in GitHub pull request #3452
2026-07-31: advisory: CVE-2026-14538 published by NVD

References

https://github.com/googleapis/mcp-toolbox/pull/3452

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.