# CVE-2026-15829: Google MCP Toolbox SQL injection in BigQuery forecasting tool

Source: https://junglewise.ai/threats/cve-2026-15829-google-mcp-toolbox-sql-injection-in-bigquery-forecasting-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-15829 · Severity: info · CVSS 8.6 · Published 2026-07-21

A security vulnerability exists in the Google BigQuery forecasting tool, which is part of the MCP Toolbox. The tool fails to properly clean user-provided data before using it in database queries, allowing an attacker to bypass security restrictions designed to limit access to specific datasets. This could result in an unauthorized user reading sensitive information from any BigQuery table they can reach, potentially leading to a significant data breach.

Technologies: [Google MCP Toolbox for Databases](https://junglewise.ai/threats/technologies/mcp-toolbox-for-databases). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-15829 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15829 being exploited in the wild.

**How severe is CVE-2026-15829?** Informational severity, with a CVSS score of 8.6, published 21 July 2026.

**Which products and versions are affected?** Google MCP Toolbox for Databases 0.13.0 to 1.3.0.

**Is there a fix for CVE-2026-15829?** A patch was published on 2026-06-04: Fix merged in GitHub pull request #3324 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15829 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15829?** Check whether you run Google MCP Toolbox for Databases at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection (CWE-89) and incorrect authorization (CWE-863) vulnerability exists in the 'bigquery-forecast' tool within the googleapis/mcp-toolbox. The application uses fmt.Sprintf to interpolate client-controlled parameters—specifically data_col, timestamp_col, and id_cols—directly into an AI.FORECAST SELECT statement without proper escaping. While the tool implements an 'allowedDatasets' filter, it only validates the 'history_data' parameter and fails to re-validate the final assembled query. An attacker with low privileges can inject malicious SQL sequences into the column parameters to break out of string literals and execute multi-statement or cross-dataset queries, effectively bypassing the configured security boundaries to access unauthorized BigQuery data.

## Affected products

- Google MCP Toolbox for Databases (googleapis/mcp-toolbox) 0.13.0 to 1.3.0

## Timeline

- 2026-06-04: patched: Fix merged in GitHub pull request #3324
- 2026-07-21: disclosed: CVE published to NVD

## References

- [https://github.com/googleapis/mcp-toolbox/pull/3324](https://github.com/googleapis/mcp-toolbox/pull/3324)

## Related threats

- [Google MCP Toolbox for Databases path traversal via symlink](https://junglewise.ai/threats/cve-2026-102242-improper-link-resolution-cwe-59-cwe-22-in-the-allowedlocalroots)
- [Google MCP Toolbox SSRF and credential exfiltration in FHIR fetch tool](https://junglewise.ai/threats/cve-2026-16481-google-mcp-toolbox-ssrf-and-credential-exfiltration-in-fhir-fetch)
- [Google MCP Toolbox path traversal in HTTP tool URL builder](https://junglewise.ai/threats/cve-2026-11720-google-mcp-toolbox-path-traversal-in-http-tool-url-builder)
- [Google MCP Toolbox for Databases authorization bypass in protocol handlers](https://junglewise.ai/threats/cve-2026-11719-google-mcp-toolbox-for-databases-authorization-bypass-in-protocol)
- [Google MCP Toolbox authentication bypass in validateOpaqueToken](https://junglewise.ai/threats/cve-2026-11718-google-mcp-toolbox-authentication-bypass-in-validateopaquetoken)