Google Cloud's MCP Toolbox and Cloud Run MCP open file exfiltration and GCS bucket-squatting paths

An MCP tool that can read any path and write any bucket is a cloud exfil button with a friendly name.

Two Google Cloud MCP CVEs published 26 October 2026 make that concrete: unrestricted file and bucket parameters in MCP Toolbox's cloud-storage source, and a predictable Cloud Build bucket name in Cloud Run MCP that squatters could own first.

Arbitrary paths to GCS, and a squat on _cloudbuild

CVE-2026-93328 hits googleapis/mcp-toolbox versions 1.2.0 through 1.4.0. In internal/sources/cloudstorage/cloudstorage.go, UploadObject opened whatever local source path the tool received and uploaded it to whatever bucket name arrived in parameters. DownloadObject wrote a GCS object to an arbitrary destination. Neither call enforced a workspace root or bucket allow-list. An unauthenticated caller or a prompt-injected agent could push host files such as credentials to an attacker-controlled bucket, or overwrite local files from GCS.

PR #3454 adds validateBucket and validateLocalPath. The operational trap is in the validator: if allowedBuckets or allowedLocalRoots is omitted or empty, validation returns success (allow all). Upgrading the binary without rewriting tools.yaml leaves the old blast radius. Operators must set both lists explicitly, for example pinning buckets to my-app-bucket and local roots to /workspace.

CVE-2026-85297 hits GoogleCloudPlatform/cloud-run-mcp (@google-cloud/cloud-run-mcp) before 1.11.0. Deploy paths that zip source for Cloud Build called ensureStorageBucketExists(projectId, "{projectId}_cloudbuild", ...). GCS bucket names are globally unique. An attacker who knew or guessed projectId could pre-create {projectId}_cloudbuild in another project with permissive IAM.

Before 1.11.0 the helper only checked bucket.exists() and then uploaded proprietary source. Version 1.11.0 (PR #300, released 28 September 2026) compares bucket.getMetadata().projectNumber to the caller's project number and falls back to a randomised {projectId}-{hex} bucket on mismatch or 403.

MCP cloud tools turned storage APIs into host pivots

Agent connectors that wrap GCS and Cloud Build sit on the hottest path between a model plan and production credentials. Teams that treated MCP Toolbox as a thin RPC layer inherited filesystem and bucket authority equal to the service account.

The empty-default allow-list is the same class of failure as "optional auth" elsewhere in the October agent-tool wave. Cloud Run MCP's predictable bucket name is a classic global-namespace squat against a CI upload step. Neither story recycles the published MCP reference-server filesystem TOCTOU set; these are Google Cloud product connectors with distinct CVEs.

Google open repos; maturity is configure-after-upgrade

googleapis/mcp-toolbox and cloud-run-mcp are Google-published open repositories. Cloud-storage allow-list code merged mid-June 2026; Cloud Run MCP ownership fix shipped in 1.11.0 at the end of September; CVE identifiers published 26 October. Maturity: treat cloud-storage sources without explicit allow-lists as still exposed even on fixed commits, and treat Cloud Run MCP below 1.11.0 as overdue for CI deploy paths.

Patch, then prove the YAML deny-by-default

Upgrade MCP Toolbox past the 1.4.0 affected window with PR #3454 included, then add non-empty allowedBuckets and allowedLocalRoots to every cloud-storage source before restarting. Upgrade @google-cloud/cloud-run-mcp to 1.11.0 or later, confirm in Cloud Console that {projectId}_cloudbuild is owned by your project number, and rotate any source that may have landed in a foreign bucket. Re-run a negative test: tool calls with off-allow-list paths and buckets must fail closed.

Empty YAML, service-account sprawl, and assumed bucket ownership

The failure mode that survives a careless upgrade is an empty allow-list field that validates as allow-all. A second failure mode is a powerful runtime service account combined with UploadObject, which turns one prompt injection into credential theft. A third is assuming {projectId}_cloudbuild was always yours because the string looked internal. Shared agent hosts that expose these MCP servers beyond a trusted loopback widen all three.

Make allow-lists mandatory in every cloud MCP image

Pin patched Toolbox and cloud-run-mcp versions, fail CI if cloud-storage sources omit allow-lists, and inventory GCS buckets matching *_cloudbuild. The open Monday question is how many agent images upgraded the binary and left tools.yaml on factory defaults.