This vulnerability (CWE-59 / CWE-22) arises from improper link resolution in the allowedLocalRoots path validation mechanism of Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0. The path validation performs lexical checks on directory paths without resolving symbolic links beforehand. Consequently, a remote authenticated attacker with execution permissions on the tool can exploit symbolic links to bypass directory boundary restrictions, enabling unauthorized access or overwriting of arbitrary local files outside the allowed root directories.

An attacker with authenticated access and tool execution permissions can bypass directory boundary restrictions, potentially accessing or modifying arbitrary files on the local filesystem outside the intended allowed directories. This could lead to unauthorized data disclosure or data tampering. The CVSS 4.0 base score is 8.6 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict tool execution permissions to trusted users only and monitor for suspicious activity related to symbolic link usage.