The MCP tool appears to offer cloud-storage operations, but the implementation also reads local filesystem paths and chooses storage buckets under the Toolbox process identity. If untrusted tool parameters are not restricted, a caller can turn an apparently narrow cloud operation into broader data movement under service credentials. CVE-2026-93328…
Inspect the ClaimsCase · DiggingBeagle record
Google MCP Toolbox cloud storage tools trusted unrestricted paths and buckets
An advisory identifies path and bucket-scope weaknesses in Google MCP Toolbox versions 1.2 through 1.4. Version 1.5.0 introduces allowlist controls, but the allowed configuration remains deployment dependent.
Scope
The adversary must reach an authorized or exposed MCP tool. Whether a remote unauthenticated party can invoke it depends on deployment authentication and network exposure. No real customer data loss is confirmed.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-10 cites SRC-2026-CP21-GOOGLE-MCP-TOOLBOX-GCS at CVE-2026-93328, Path Traversal and Missing Authorization description. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting research_demonstration; exploit status not_established; remediation status patch_available. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-10 · GitHub advisory CVE-2026-93328: Google MCP Toolbox cloud storage authorization
At a glance
The mechanism is a mismatch between a tool name, parameter-derived resource scope and the actual process permissions.
Read the implicationsThe adversary must reach an authorized or exposed MCP tool. Whether a remote unauthenticated party can invoke it depends on deployment authentication and network exposure. No real customer data loss is confirmed.
Limits and uncertaintyFull account
The MCP tool appears to offer cloud-storage operations, but the implementation also reads local filesystem paths and chooses storage buckets under the Toolbox process identity. If untrusted tool parameters are not restricted, a caller can turn an apparently narrow cloud operation into broader data movement under service credentials.
CVE-2026-93328 describes Google MCP Toolbox cloud storage tools that can access local files or selected buckets beyond intended caller scope, and a 1.5.0 fix introducing allowedLocalRoots and allowedBuckets controls. The adversary must reach an authorized or exposed MCP tool. Whether a remote unauthenticated party can invoke it depends on deployment authentication and network exposure. No real customer data loss is confirmed.
Upgrade and explicitly configure both permitted local roots and bucket IDs. Verify effective defaults with denied-path and denied-bucket tests rather than assuming that the presence of allowlist options means they are active. The mechanism is a mismatch between a tool name, parameter-derived resource scope and the actual process permissions. Primary evidence.
Additional evidence and trust boundary
A cloud-storage helper can unintentionally become both a local file reader and an exfiltration router. Version 1.5.0 provides allowedLocalRoots and allowedBuckets controls, but their effective configured values are the decisive boundary. An upgrade without explicit safe configuration should not be described as a proof of least privilege. Confirm the caller can invoke the tool and test all path and bucket operations under the service identity. Supporting record.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 26, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-10The advisory identifies two separate exposure classes in MCP Toolbox cloud-storage tools: local filesystem paths reached under the Toolbox process credentials and remote bucket selection not necessarily constrained to a caller-approved bucket.supported
Basis: reported finding
- supportsGitHub advisory CVE-2026-93328: Google MCP Toolbox cloud storage authorizationprimary disclosure
CVE-2026-93328, Path Traversal and Missing Authorization description
CLM-CP21-GOOGLE-MCP-TOOLBOX-GCS-1CVE-2026-93328 describes Google MCP Toolbox cloud storage tools that can access local files or selected buckets beyond intended caller scope, and a 1.5.0 fix introducing allowedLocalRoots and allowedBuckets controls.supported
Basis: reported finding
- supportsGitHub advisory CVE-2026-93328: Google MCP Toolbox cloud storage authorizationprimary disclosure
Advisory description, affected release range and allowlist remediation
Implications
The mechanism is a mismatch between a tool name, parameter-derived resource scope and the actual process permissions.
Controls and mitigations
- Upgrade and explicitly configure both permitted local roots and bucket IDs. Verify effective defaults with denied-path and denied-bucket tests rather than assuming that the presence of allowlist options means they are active.
Unknowns and contradictions
- The adversary must reach an authorized or exposed MCP tool. Whether a remote unauthenticated party can invoke it depends on deployment authentication and network exposure. No real customer data loss is confirmed.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196