CVE-2026-102242

Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

State: Published
Severity: 8.6 High
Published: Sep 29, 2026
Updated: Sep 29, 2026
Reserved: Sep 28, 2026

Description

Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path validation checks directories lexically without resolving symbolic links first, an attacker can access or overwrite arbitrary local files located outside the permitted root directories.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	Google

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
MCP Toolbox for DatabasesGoogle	1.2.0 through 1.9.0Affected

References

https://github.com/googleapis/mcp-toolbox/pull/3810

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.