CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox
Attackers can inject SQL into BigQuery forecasting tools to bypass dataset restrictions and read arbitrary tables.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15829?
CVE-2026-15829 is a high-severity SQL injection vulnerability in MCP Toolbox for Databases (googleapis/mcp-toolbox), published on 21 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapis/mcp-toolbox.
The tool accepts client-controlled parameters (data_col, timestamp_col, and id_cols) as plain strings and interpolates them unescaped via fmt.Sprintf directly into a generated AI.FORECAST table-valued SELECT statement. While MCP Toolbox utilizes an allowedDatasets mechanism to restrict queries, this defense only validates the history_data parameter; the final assembled query is executed without re-validation.
An attacker can break out of the string literal fields (such as timestamp_col) to inject a valid multi-statement or cross-dataset query block. This allows an unauthorized user to bypass the operator-configured allowedDatasets boundary and read arbitrary BigQuery tables.
Which versions are affected by CVE-2026-15829?
It affects 1 product.
Products include Google Mcp Toolbox for Databases.
How do I fix CVE-2026-15829?
No fix has been published for CVE-2026-15829 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-15829 being exploited?
There is no known exploitation of CVE-2026-15829 in the wild and no public exploit code.
Other vulnerabilities in MCP Toolbox for Databases (googleapis/mcp-toolbox)
- CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
- CVE-2026-11717 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
- CVE-2026-11718 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
- CVE-2026-11719 MCP Toolbox for Databases: authenticated authorization bypass
- CVE-2026-14537 Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
Sources
Also known as GHSA-wvx3-gvxv-cmxc.