PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14538 Google CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T02:16:28.757Z and has not been modified since then. The bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 has an improper authorization and security-boundary bypass vulnerability; an authenticated attacker can bypass allowedDatasets validation checks due to a fail-open logic flaw in the BigQuery dry-run API. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections. Users of Google mcp-toolbox versions 0.16.1 through 1.4.0, administrators of BigQuery datasets, and security teams monitoring for potential authorization bypass vulnerabilities should verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage to prevent potential attacks. The CVE record was published on 2026-07-31T02:16:28.757Z and has not been modified since then. The vulnerability exists in bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0; verify affected versions and check for updates.

Vendor
Google
Product
mcp-toolbox
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-31
Original CVE updated
2026-07-31
Advisory published
2026-07-31
Advisory updated
2026-07-31

Who should care

Users of Google mcp-toolbox versions 0.16.1 through 1.4.0, administrators of BigQuery datasets, and security teams monitoring for potential authorization bypass vulnerabilities. They should verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage to prevent potential attacks.

Technical summary

The bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 has an improper authorization and security-boundary bypass vulnerability; an authenticated attacker can bypass allowedDatasets validation checks due to a fail-open logic flaw in the BigQuery dry-run API. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections.

Defensive priority

Authenticated attackers may bypass dataset restrictions to extract structural DDL schemas and access federated row data; verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage.

Recommended defensive actions

  • Verify allowedDatasets validation checks in bigquery-execute-sql tool component
  • Monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage
  • Check for updates to Google mcp-toolbox versions 0.16.1 through 1.4.0
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0; verify affected versions and check for updates. The CVE record was published on 2026-07-31T02:16:28.757Z and has not been modified since then. Users should verify allowedDatasets validation checks and monitor for INFORMATION_SCHEMA and EXTERNAL_QUERY usage.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-31T02:16:28.757Z and has not been modified since then.