Improper Authorization Bypass in Google mcp-toolbox

Executive Summary

This vulnerability is an improper authorization and security-boundary bypass in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0. It allows an authenticated attacker to bypass dataset validation checks by exploiting a fail-open logic flaw in the BigQuery dry-run API. When the API returns an empty array for certain constructs, the toolbox incorrectly allows access to restricted datasets.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper authorization in Google mcp-toolbox's bigquery-execute-sql tool. Detection requires checking tool versions and validating BigQuery API responses for dataset restrictions. No direct commands are provided in the context to detect this issue.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to extract structural DDL schemas for datasets that should be excluded. They may also access downstream federated row data via EXTERNAL_QUERY connections, potentially leading to unauthorized data exposure or data leakage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to sensitive data through improper authorization bypass, which could lead to violations of data protection regulations like GDPR and HIPAA. Unauthorized extraction of DDL schemas and access to federated row data may result in unauthorized data processing or disclosure, triggering compliance breaches under these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update Google mcp-toolbox to a version beyond 1.4.0 where the authorization bypass flaw is fixed. If immediate update is not possible, restrict access to the bigquery-execute-sql tool and monitor for unauthorized INFORMATION_SCHEMA or EXTERNAL_QUERY usage.

Useful 0 Not Useful 0