GitHub advisory CVE-2026-93328: Google MCP Toolbox cloud storage authorization

Evidence record

GitHub advisory CVE-2026-93328: Google MCP Toolbox cloud storage authorization

Read the original source ↗

Claim-level citations (2)

• supportsGoogle MCP Toolbox cloud storage tools trusted unrestricted paths and buckets: The advisory identifies two separate exposure classes in MCP Toolbox cloud-storage tools: local filesystem paths reached under the Toolbox process credentials and remote bucket selection not necessarily constrained to a caller-approved bucket.

  CVE-2026-93328, Path Traversal and Missing Authorization description

• supportsGoogle MCP Toolbox cloud storage tools trusted unrestricted paths and buckets: CVE-2026-93328 describes Google MCP Toolbox cloud storage tools that can access local files or selected buckets beyond intended caller scope, and a 1.5.0 fix introducing allowedLocalRoots and allowedBuckets controls.

  Advisory description, affected release range and allowlist remediation