{"metadata": {"vulnerability": "CVE-2026-93328", "count": 19, "kinds": {"milestone": 4, "sighting": 7, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-17T17:27:06.678Z", "date_only": false, "value": "2026-09-17T17:27:06.678Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-26T14:24:09.012Z", "date_only": false, "value": "2026-10-26T14:24:09.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T14:24:09.012Z", "date_only": false, "value": "2026-10-26T14:24:09.012Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GoogleCloud", "record": "CVE-2026-93328", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T15:15:38.567Z", "date_only": false, "value": "2026-10-26T15:15:38.567947Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507865837876090", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "bc4aeb54-8449-4e4c-88b6-50230033f89a", "content": "CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.\nhttps://www.cve.org/CVERecord?id=CVE-2026-93328https://github.com/googleapis/mcp-toolbox/pull/3454#GoogleCloud #MCPToolboxforDatabases(googleapis/mcp-toolbox)#CVE_2026_93328#bot", "url": "https://infosec.exchange/users/cve/statuses/117507865837876090"}, {"timestamp": "2026-10-26T15:16:45Z", "date_only": false, "value": "2026-10-26T15:16:45Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2GC9-C85V-5VWR", "record": "GHSA-2GC9-C85V-5VWR", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-26T15:16:45.813Z", "date_only": false, "value": "2026-10-26T15:16:45.813", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93328", "record": "FKIE_CVE-2026-93328", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:33:21.057Z", "date_only": false, "value": "2026-10-26T15:33:21.057931Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93328", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-26T15:33:21.057Z", "date_only": false, "value": "2026-10-26T15:33:21.057931Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93328", "record": "FKIE_CVE-2026-93328", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-26T15:34:48Z", "date_only": false, "value": "2026-10-26T15:34:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2GC9-C85V-5VWR", "record": "GHSA-2GC9-C85V-5VWR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T15:34:48Z", "date_only": false, "value": "2026-10-26T15:34:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2GC9-C85V-5VWR", "record": "GHSA-2GC9-C85V-5VWR", "field": "modified"}, {"timestamp": "2026-10-26T15:50:07.321Z", "date_only": false, "value": "2026-10-26T15:50:07.321098Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mys36eqmvh2y", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "168daf73-25a0-437e-b15c-464cc751f6b3", "content": "CVE-2026-93328\nVersions 1.2.0 to 1.4.0 of the Google Cloud MCP Toolbox for Databases let anyone run the tool with specially crafted settings to read any file on the server and send it to a cloud storage bucket, or to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mys36eqmvh2y"}, {"timestamp": "2026-10-26T16:04:21.519Z", "date_only": false, "value": "2026-10-26T16:04:21.519107Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117508057297120473", "record": "cve-2026-93328", "field": "creation_timestamp", "uuid": "24e5355a-647b-48ad-923e-a8599d23eb59", "content": "Go ../ more MCP bullshit.\nhttps://nvd.nist.gov/vuln/detail/cve-2026-93328\nsev:CRIT 9.3 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Amber\n\nPath Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.", "url": "https://infosec.exchange/users/cR0w/statuses/117508057297120473"}, {"timestamp": "2026-10-26T16:09:00.601Z", "date_only": false, "value": "2026-10-26T16:09:00.601353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mys4a5x3bn2b", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "0eb4f503-68de-4c40-bd53-07829cd4e750", "content": "\ud83d\udea8 CVE-2026-93328 \u2014 CVSS 9.3 CRITICAL\n\nPath Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93328\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mys4a5x3bn2b"}, {"timestamp": "2026-10-26T16:46:45.879Z", "date_only": false, "value": "2026-10-26T16:46:45.879Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T16:46:45.879Z", "date_only": false, "value": "2026-10-26T16:46:45.879Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-93328", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T17:17:31.020Z", "date_only": false, "value": "2026-10-26T17:17:31.020", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-93328", "record": "FKIE_CVE-2026-93328", "field": "lastModified"}, {"timestamp": "2026-10-27T07:00:16Z", "date_only": false, "value": "2026-10-27T07:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gE1VyP1Y3WOraRvY0NYKiDFDzyI1c3m_Le2tR5xigScRr0s", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "a100576a-9cac-4b59-97fa-7ce0a1c26782", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-27T07:00:16Z", "date_only": false, "value": "2026-10-27T07:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/gE1VyP1Y3WOraRvY0NYKiDFDzyI1c3m_Le2tR5xigScRr0s", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "4dd5616f-570f-4607-ab0d-218576279354"}, {"timestamp": "2026-10-27T21:08:02.239Z", "date_only": false, "value": "2026-10-27T21:08:02.239810Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3myv5frg2cq2d", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "c6bd02b2-27fe-4a77-bce2-66e467d7035f", "content": "\ud83d\udea8 Google's MCP-Toolbox for databases released CVE-2026-93328. A Path Traversal and Missing Authorization allows an unauthenticated attacker to extract host files from your server to their own Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.", "url": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3myv5frg2cq2d"}], "metrics": {"as_of": "2026-10-29T13:45:28.359Z", "anchors": {"origin": {"timestamp": "2026-10-26T14:24:09.012Z", "date_only": false, "value": "2026-10-26T14:24:09.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-26T14:24:09.012Z", "date_only": false, "value": "2026-10-26T14:24:09.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-27T07:00:16Z", "date_only": false, "value": "2026-10-27T07:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gE1VyP1Y3WOraRvY0NYKiDFDzyI1c3m_Le2tR5xigScRr0s", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "a100576a-9cac-4b59-97fa-7ce0a1c26782", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 59766.988, "hours": 16.60194111111111, "days": 0.6917475462962963, "min_seconds": 59766.988, "max_seconds": 59766.988, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T14:24:09.012Z", "date_only": false, "value": "2026-10-26T14:24:09.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-27T07:00:16Z", "date_only": false, "value": "2026-10-27T07:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gE1VyP1Y3WOraRvY0NYKiDFDzyI1c3m_Le2tR5xigScRr0s", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "a100576a-9cac-4b59-97fa-7ce0a1c26782", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 256879.347088, "hours": 71.35537419111111, "days": 2.9731405912962963, "min_seconds": 256879.347088, "max_seconds": 256879.347088, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T14:24:09.012Z", "date_only": false, "value": "2026-10-26T14:24:09.012Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-93328", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T13:45:28.359Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 197112.359088, "hours": 54.75343308, "days": 2.281393045, "min_seconds": 197112.359088, "max_seconds": 197112.359088, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T07:00:16Z", "date_only": false, "value": "2026-10-27T07:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/gE1VyP1Y3WOraRvY0NYKiDFDzyI1c3m_Le2tR5xigScRr0s", "record": "CVE-2026-93328", "field": "creation_timestamp", "uuid": "a100576a-9cac-4b59-97fa-7ce0a1c26782", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T13:45:28.359Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}