Executive brief
A security flaw in Google's mcp-toolbox, a set of tools for Model Context Protocol integrations, allows users to bypass data access restrictions in BigQuery. An attacker with valid credentials could view the structure of databases they are supposed to be blocked from and potentially access data in external connected systems. This could lead to unauthorized exposure of sensitive data schemas and downstream information.
Technical details
An improper authorization vulnerability (CWE-285/CWE-863) exists in the bigquery-execute-sql tool within Google mcp-toolbox versions 0.16.1 through 1.4.0. The component relies on the BigQuery dry-run API to enforce 'allowedDatasets' restrictions; however, a fail-open logic flaw occurs when the API returns an empty array for specific SQL constructs. An authenticated attacker can exploit this to extract DDL schemas for excluded datasets via INFORMATION_SCHEMA or access federated row data using EXTERNAL_QUERY connections. The issue is addressed in pull request #3452 by implementing a mandatory table parser and restricting specific metadata views.
Affected products
- Google mcp-toolbox 0.16.1 through 1.4.0
Timeline
- 2026-06-18: patched: Fix merged in GitHub pull request #3452
- 2026-07-31: advisory: CVE-2026-14538 published by NVD