# CVE-2026-14538: Google mcp-toolbox auth bypass in bigquery-execute-sql

Source: https://junglewise.ai/threats/cve-2026-14538-google-mcp-toolbox-auth-bypass-in-bigquery-execute-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-14538 · Severity: info · CVSS 5.7 · Published 2026-07-31

A security flaw in Google's mcp-toolbox, a set of tools for Model Context Protocol integrations, allows users to bypass data access restrictions in BigQuery. An attacker with valid credentials could view the structure of databases they are supposed to be blocked from and potentially access data in external connected systems. This could lead to unauthorized exposure of sensitive data schemas and downstream information.

Technologies: [Google MCP Toolbox](https://junglewise.ai/threats/technologies/mcp-toolbox). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-14538 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14538 being exploited in the wild.

**How severe is CVE-2026-14538?** Informational severity, with a CVSS score of 5.7, published 31 July 2026.

**Which products and versions are affected?** Google MCP Toolbox 0.16.1 through 1.4.0.

**Is there a fix for CVE-2026-14538?** A patch was published on 2026-06-18: Fix merged in GitHub pull request #3452 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14538 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14538?** Check whether you run Google MCP Toolbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-285/CWE-863) exists in the bigquery-execute-sql tool within Google mcp-toolbox versions 0.16.1 through 1.4.0. The component relies on the BigQuery dry-run API to enforce 'allowedDatasets' restrictions; however, a fail-open logic flaw occurs when the API returns an empty array for specific SQL constructs. An authenticated attacker can exploit this to extract DDL schemas for excluded datasets via INFORMATION_SCHEMA or access federated row data using EXTERNAL_QUERY connections. The issue is addressed in pull request #3452 by implementing a mandatory table parser and restricting specific metadata views.

## Affected products

- Google mcp-toolbox 0.16.1 through 1.4.0

## Timeline

- 2026-06-18: patched: Fix merged in GitHub pull request #3452
- 2026-07-31: advisory: CVE-2026-14538 published by NVD

## References

- [https://github.com/googleapis/mcp-toolbox/pull/3452](https://github.com/googleapis/mcp-toolbox/pull/3452)

## Related threats

- [Google mcp-toolbox authentication bypass in Google OAuth provider](https://junglewise.ai/threats/cve-2026-14541-google-mcp-toolbox-authentication-bypass-in-google-oauth-provider)
- [Google mcp-toolbox SSRF in HTTP source component](https://junglewise.ai/threats/cve-2026-14540-google-mcp-toolbox-ssrf-in-http-source-component)
- [Google mcp-toolbox denial of service in HTTP handler](https://junglewise.ai/threats/cve-2026-14539-google-mcp-toolbox-denial-of-service-in-http-handler)
- [Google mcp-toolbox authorization bypass in legacy HTTP API](https://junglewise.ai/threats/cve-2026-14537-google-mcp-toolbox-authorization-bypass-in-legacy-http-api)
- [Google MCP Toolbox path traversal in HTTP tool URL builder](https://junglewise.ai/threats/cve-2026-11720-google-mcp-toolbox-path-traversal-in-http-tool-url-builder)