Is CVE-2026-15829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15829 being exploited in the wild.

How severe is CVE-2026-15829?

Informational severity, with a CVSS score of 8.6, published 21 July 2026.

Which products and versions are affected?

Google MCP Toolbox for Databases 0.13.0 to 1.3.0.

Is there a fix for CVE-2026-15829?

A patch was published on 2026-06-04: Fix merged in GitHub pull request #3324 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15829?

Check whether you run Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15829: Google MCP Toolbox SQL injection in BigQuery forecasting tool

CVE-2026-15829 · Severity: info · CVSS 8.6 · Published 2026-07-21

A security vulnerability exists in the Google BigQuery forecasting tool, which is part of the MCP Toolbox. The tool fails to properly clean user-provided data before using it in database queries, allowing an attacker to bypass security restrictions designed to limit access to specific datasets. This could result in an unauthorized user reading sensitive information from any BigQuery table they can reach, potentially leading to a significant data breach.

Technologies: Google MCP Toolbox for Databases. Vendors: Google.

Quick answers

Is CVE-2026-15829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15829 being exploited in the wild.
How severe is CVE-2026-15829?: Informational severity, with a CVSS score of 8.6, published 21 July 2026.
Which products and versions are affected?: Google MCP Toolbox for Databases 0.13.0 to 1.3.0.
Is there a fix for CVE-2026-15829?: A patch was published on 2026-06-04: Fix merged in GitHub pull request #3324 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15829?: Check whether you run Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection (CWE-89) and incorrect authorization (CWE-863) vulnerability exists in the 'bigquery-forecast' tool within the googleapis/mcp-toolbox. The application uses fmt.Sprintf to interpolate client-controlled parameters—specifically data_col, timestamp_col, and id_cols—directly into an AI.FORECAST SELECT statement without proper escaping. While the tool implements an 'allowedDatasets' filter, it only validates the 'history_data' parameter and fails to re-validate the final assembled query. An attacker with low privileges can inject malicious SQL sequences into the column parameters to break out of string literals and execute multi-statement or cross-dataset queries, effectively bypassing the configured security boundaries to access unauthorized BigQuery data.

Affected products

Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 0.13.0 to 1.3.0

Timeline

2026-06-04: patched: Fix merged in GitHub pull request #3324
2026-07-21: disclosed: CVE published to NVD

References

https://github.com/googleapis/mcp-toolbox/pull/3324

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.