CVE-2026-14538 Google CVE debrief

Who should care

Users of Google mcp-toolbox versions 0.16.1 through 1.4.0, administrators of BigQuery datasets, and security teams monitoring for potential authorization bypass vulnerabilities. They should verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage to prevent potential attacks.

Technical summary

The bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 has an improper authorization and security-boundary bypass vulnerability; an authenticated attacker can bypass allowedDatasets validation checks due to a fail-open logic flaw in the BigQuery dry-run API. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.

Defensive priority

Authenticated attackers may bypass dataset restrictions to extract structural DDL schemas and access federated row data; verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage.

Recommended defensive actions

• Verify allowedDatasets validation checks in bigquery-execute-sql tool component
• Monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage
• Check for updates to Google mcp-toolbox versions 0.16.1 through 1.4.0
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0; verify affected versions and check for updates. The CVE record was published on 2026-07-31T02:16:28.757Z and has not been modified since then. Users should verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.