The vulnerability in googleapis/mcp-toolbox version 0.13.0 involves improper neutralization of special elements in SQL commands (CWE-89) and a security boundary bypass (CWE-863) in the BigQuery forecasting tool (bigquery-forecast). Client-controlled parameters such as data_col, timestamp_col, and id_cols are directly interpolated into SQL queries via fmt.Sprintf without escaping, enabling attackers to break out of string literals and inject multi-statement or cross-dataset queries. Although an allowedDatasets mechanism exists, it only validates the history_data parameter and does not re-validate the final assembled query, allowing unauthorized data access across BigQuery datasets.

Exploitation of this vulnerability allows an attacker with limited privileges to perform SQL injection attacks that bypass dataset access controls configured by the operator. This can lead to unauthorized reading of arbitrary BigQuery tables beyond the intended scope, potentially exposing sensitive data. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor (Google) manages remediation server-side. Users should verify with the vendor advisory that their instance is updated to a patched version or that the service is protected. Until patched, avoid using the affected version 0.13.0 of MCP Toolbox for Databases. No additional mitigation steps are specified in the advisory.