CVE-2026-15829 affects the prebuilt bigquery-forecast tool in Google’s MCP Toolbox for Databases. The CNA record says versions 0.13.0 through 1.3.0 can construct an AI.FORECAST query from client-controlled column parameters without sufficient neutralization. The same record describes an authorization boundary bypass: a configured dataset allowlist was not applied again to the fully assembled statement.
This is a vulnerability in a specific MCP server tool and its BigQuery query construction, not a defect established in the Model Context Protocol specification. Its MCP relevance is operational: an agent or client that can invoke the affected tool may be able to influence a cloud query beyond the operator’s intended dataset boundary.
What the Google CVE record establishes
The CVE record was published by Google on July 21, 2026. It assigns CWE-89 for SQL injection and CWE-863 for incorrect authorization. The affected product is MCP Toolbox for Databases, also published from the googleapis/mcp-toolbox repository. The listed affected range is 0.13.0 through 1.3.0 inclusive; the record’s default status is unaffected outside that range.
The record describes three plain-string inputs—data_col, timestamp_col, and id_cols—being interpolated into a generated BigQuery forecasting statement. It also says the allowedDatasets control checked the history-data parameter but did not re-validate the final assembled query. That distinction matters: a policy check on one input is not equivalent to authorization of the complete query that reaches the cloud service.
Impact and practical exposure
Google’s CNA assigns a CVSS 4.0 score of 8.6, High, with network attack vector, low complexity, low privileges, no user interaction, and high vulnerability confidentiality and integrity impact. The score is a source-assigned model, not a measurement of every deployment. Exposure depends on whether the forecasting tool is enabled, which clients can call it, what BigQuery credentials the Toolbox process uses, and whether those credentials can access sensitive datasets.
The public CVE enrichment from CISA records exploitation as none and automatable as no at the time of review. That is not evidence that the issue is harmless, nor is it evidence of a confirmed incident. MCPwatch did not reproduce the issue and has no visibility into live MCP Toolbox deployments.
Patch and version evidence
The maintainer’s security fix pull request says the change addresses the BigQuery forecast and analysis tools. It describes quoting option values and dry-running the complete assembled statement so dataset access can be inspected, including access hidden behind views. The pull request was merged on June 4.
The project’s 1.4.0 release notes, published the same day, list “Prevent allowedDatasets bypass in forecast query” as a bug fix and link commit 45df461. The minimum remediation boundary supported by these records is 1.4.0. Later releases exist; operators should prefer a currently supported release after reviewing its compatibility notes rather than stopping at the minimum patch.
Defensive actions for operators
- Inventory the effective binary. Check the running container, binary provenance, startup arguments, and deployment manifest. Do not rely only on a source checkout or an intended version.
- Upgrade affected installations. Replace 0.13.0 through 1.3.0 with a current supported release at or above 1.4.0, then verify the version actually serving MCP requests.
- Review tool exposure. Determine whether
bigquery-forecastis enabled and which MCP principals or networks can invoke it. Remove unused tools and narrow client access. - Reduce cloud privilege. Use a dedicated BigQuery identity with the smallest practical dataset and operation permissions. Treat an allowlist in the MCP layer as defense in depth, not as a substitute for cloud authorization.
- Re-check policy boundaries. Confirm that the deployed release validates the complete generated query and that views, authorized views, and cross-project references are handled as intended.
- Review evidence without assuming intrusion. Examine BigQuery audit logs for unusual datasets, query jobs, service accounts, and time windows. A vulnerable version alone does not prove that data was read.
Assessment
CVE-2026-15829 illustrates a recurring MCP security boundary: tool-level input policy cannot be trusted if the final cloud query is assembled later without a complete authorization check. The practical response is to upgrade, restrict who can invoke the forecasting tool, enforce least privilege in BigQuery, and validate the effective query boundary in deployment testing.
The reviewed primary records support a high-severity, configuration-dependent vulnerability with a documented fix in 1.4.0. They do not support a claim of known exploitation in the wild or a claim that every MCP Toolbox deployment is exposed in the same way.