Executive brief
A security vulnerability exists in the Google BigQuery forecasting tool, which is part of the MCP Toolbox. The tool fails to properly clean user-provided data before using it in database queries, allowing an attacker to bypass security restrictions designed to limit access to specific datasets. This could result in an unauthorized user reading sensitive information from any BigQuery table they can reach, potentially leading to a significant data breach.
Technical details
A SQL injection (CWE-89) and incorrect authorization (CWE-863) vulnerability exists in the 'bigquery-forecast' tool within the googleapis/mcp-toolbox. The application uses fmt.Sprintf to interpolate client-controlled parameters—specifically data_col, timestamp_col, and id_cols—directly into an AI.FORECAST SELECT statement without proper escaping. While the tool implements an 'allowedDatasets' filter, it only validates the 'history_data' parameter and fails to re-validate the final assembled query. An attacker with low privileges can inject malicious SQL sequences into the column parameters to break out of string literals and execute multi-statement or cross-dataset queries, effectively bypassing the configured security boundaries to access unauthorized BigQuery data.
Affected products
- Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 0.13.0 to 1.3.0
Timeline
- 2026-06-04: patched: Fix merged in GitHub pull request #3324
- 2026-07-21: disclosed: CVE published to NVD