The MCP Toolbox for Databases’ BigQuery forecasting tool builds queries by inserting client‑supplied column names directly into a formatted SQL string. This permits SQL injection (CWE‑89) and, because the tool validates only a single parameter, it also bypasses the allowedDatasets security boundary (CWE‑863). An attacker can terminate the intended string literal and inject arbitrary DML or cross‑dataset SELECT statements, thereby reading any BigQuery table for which they have permissions beyond those intended by the allowedDatasets policy.

The affected product is Google’s MCP Toolbox for Databases, specifically the BigQuery forecasting command known as bigquery‑forecast. No specific version constraints are listed, meaning all releases that include the bigquery‑forecast tool are potentially impacted unless patched.

The CVSS score of 8.6 indicates that, if exploited, the attacker can cause a significant breach of confidentiality by exfiltrating data. The EPSS score of less than 1% suggests that the likelihood of an immediate exploit is low, and the vulnerability is not listed in the CISA KEV catalog, which reduces the chance of a known active exploit. However, because the attack vector relies on normal user input, an attacker who can craft requests to the forecast API can bypass the intended dataset restrictions and read arbitrary BigQuery tables with the permissions of the user or service account that runs the tool.