This vulnerability in Google mcp-toolbox versions 0.16.1 through 1.4.0 involves improper authorization and security-boundary bypass in the bigquery-execute-sql tool. The toolbox uses the BigQuery dry-run API to enforce dataset restrictions, but a fail-open logic flaw causes validation to be bypassed when the API returns an empty array for specialized constructs. As a result, an authenticated attacker can extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA and access downstream federated row data through EXTERNAL_QUERY connections. The vulnerability has a CVSS 4.0 score of 5.7 (medium severity). The product is a cloud service, and the vendor manages remediation.

An authenticated attacker can bypass allowed dataset validation checks, potentially exposing structural schema information and federated query data from datasets that should be restricted. This could lead to unauthorized data disclosure within the affected cloud service environment.

The vendor manages remediation for this cloud-hosted service. A patch is available, but no explicit remediation level or patch details are provided in the advisory. Users should consult the vendor advisory for current remediation guidance and ensure their service is updated accordingly.