The bigquery‑execute‑sql component of Google MCP Toolbox has a fail‑open authorization flaw that lets an authenticated caller sidestep allowedDatasets checks when the BigQuery dry‑run API returns an empty result for certain query constructs. This permits the attacker to discover the DDL structure of datasets that are explicitly excluded and to retrieve federated row data via EXTERNAL_QUERY connections, effectively leaking sensitive schema and data. The weakness is a combination of improper authentication (CWE‑285) and insecure object reference (CWE‑863).

Google MCP Toolbox, component bigquery‑execute‑sql, affected versions from 0.16.1 through 1.4.0 inclusive. Any deployment that uses these versions and allows authenticated users to invoke the tool is vulnerable.

Based on the description, it is inferred that exploitation requires a valid authenticated session with permissions to run the tool, limiting the attack surface to users who already have access to Google Cloud artifacts. The CVSS score of 5.7 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting low to moderate exploit likelihood. Still, the ability to read secure schema and possibly extract data makes it a noteworthy risk for organizations that rely on strict dataset isolation.