The prebuilt BigQuery forecasting tool (bigquery-forecast) in googleapis/mcp-toolbox accepts client-controlled parameters (data_col, timestamp_col, and id_cols) as plain strings and directly interpolates them via fmt.Sprintf into AI.FORECAST table-valued SELECT statements without escaping. Although the tool uses an allowedDatasets mechanism to restrict queries, this mechanism only validates the history_data parameter and does not re-validate the final assembled query. Consequently, an attacker can break out of string literal fields to inject multi-statement or cross-dataset queries, bypassing dataset boundaries and accessing unauthorized BigQuery tables.

An attacker with the ability to control certain query parameters can perform SQL injection to execute unauthorized queries across dataset boundaries. This leads to unauthorized disclosure of arbitrary BigQuery tables beyond the operator-configured allowedDatasets restrictions. The vulnerability compromises data confidentiality within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the vulnerable parameters with untrusted input or apply strict input validation and escaping on client-controlled parameters to prevent injection. Monitor vendor channels for updates regarding patches or official mitigations.