Vulnerability · Published Sep 29, 2026 · Assigned by Google

CVE-2026-102242Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

High 8.6

In plain English

A high-severity path traversal in MCP Toolbox for Databases from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.

Affected products (as reported)

Vendor	Product	Versions
Google	MCP Toolbox for Databases	1.2.0 – through 1.9.0

Weakness: CWE-59, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/googleapis/mcp-toolbox/pull/3810