A critical vulnerability (CVE-2026-93328) exists in Google Cloud MCP Toolbox for Databases versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted parameters.