CVE-2026-10277: MCP Google Workspace Auth Bypass Flaw

CVE-2026-10277 Overview

CVE-2026-10277 is an improper access control vulnerability in the j3k0/mcp-google-workspace project, a Model Context Protocol (MCP) server for Google Workspace. The flaw resides in the saveToDisk function within src/tools/gmail.ts, which is part of the MCP Gmail Tool component. The function fails to constrain attacker-controlled file paths when writing Gmail attachments to disk, allowing a remote authenticated caller to write files outside the intended directory. The issue is classified under [CWE-266: Incorrect Privilege Assignment], and the maintainer addressed it in commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c.

Critical Impact
A low-privileged remote actor can manipulate the attachment save path to write files outside the intended directory, impacting confidentiality, integrity, and availability of the host running the MCP server.

Affected Products

j3k0/mcp-google-workspace MCP server (rolling release) up to commit 831790e7d5c2663325733d9f5579cc339a267c4c
src/tools/gmail.ts MCP Gmail Tool component
Any MCP client deployment consuming the unpatched Gmail attachment handler

Discovery Timeline

2026-06-01 - CVE-2026-10277 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10277

Vulnerability Analysis

The mcp-google-workspace project exposes Gmail capabilities to MCP clients, including downloading message attachments. The pre-patch saveToDisk implementation in src/tools/gmail.ts accepted a caller-supplied filename and wrote decoded Base64 attachment data directly to that location. Because the path was not normalized against an enforced sandbox directory, an attacker controlling the MCP request could supply absolute paths, relative traversal sequences such as ../, NUL bytes, or symlink targets. The result is improper access control over the host file system from the perspective of the MCP server process.

Root Cause

The root cause is the absence of path containment logic in the attachment write helper. The function trusted the filePath argument, allowing it to resolve outside of any base directory. There was no rejection of absolute paths, traversal segments, embedded NUL bytes, or symlink escapes before invoking fs.writeFile.

Attack Vector

Exploitation requires the attacker to issue an MCP tool call to the Gmail attachment save endpoint with a crafted filePath value. Because the access vector is network-reachable and only low privileges are required, any actor able to interact with the MCP server can trigger the write. A public proof of concept is referenced in the GitHub Issue Discussion and GitHub Pull Request.

typescript

// Patch excerpt: src/tools/gmail-helpers.ts
// Source: https://github.com/j3k0/mcp-google-workspace/commit/89c091ecf8b9f9c7291d1af0b1966e271f86551c
import { Buffer } from 'buffer';
import fs from 'fs';
import os from 'os';
import * as path from 'path';

export function decodeBase64Data(fileData: string): Buffer {
  const standardBase64Data = fileData.replace(/-/g, '+').replace(/_/g, '/');
  const padding = '='.repeat((4 - standardBase64Data.length % 4) % 4);
  return Buffer.from(standardBase64Data + padding, 'base64');
}

function getAttachmentsBaseDir(): string {
  const fromEnv = process.env.GMAIL_ATTACHMENTS_DIR;
  const baseDir = fromEnv && fromEnv.length > 0
    ? path.resolve(fromEnv)
    : path.join(os.homedir(), '.mcp-gsuite', 'attachments');
  fs.mkdirSync(baseDir, { recursive: true });
  return baseDir;
}

/**
 * Resolves a caller-supplied attachment filename against the configured
 * attachments base directory (GMAIL_ATTACHMENTS_DIR, defaulting to
 * ~/.mcp-gsuite/attachments). Absolute paths, traversal, NUL bytes and
 * symlink escapes are rejected.
 */
export function resolveAttachmentPath(filePath: string): string {
  if (typeof filePath !== 'string' || filePath.length === 0 || filePath.includes('\0')) {
    throw new Error('Invalid save path');
  }
  // ... remainder of resolution logic enforces the sandbox
}

The patch introduces a dedicated gmail-helpers.ts module with resolveAttachmentPath, sandboxes writes under GMAIL_ATTACHMENTS_DIR (defaulting to ~/.mcp-gsuite/attachments), and rejects absolute paths, traversal, NUL bytes, and symlink escapes. See the GitHub Commit Details for the complete change set.

Detection Methods for CVE-2026-10277

Indicators of Compromise

Files appearing outside of ~/.mcp-gsuite/attachments or the configured GMAIL_ATTACHMENTS_DIR that were created by the MCP server process.
MCP Gmail tool requests containing filePath values with ../, absolute paths, or NUL byte sequences.
Unexpected writes by the Node.js process hosting mcp-google-workspace into system directories such as /etc, /root, or user startup folders.

Detection Strategies

Audit MCP request logs for attachment save calls whose target paths resolve outside the sandbox directory.
Monitor file creation events tied to the Node.js process running the MCP server and alert on writes to non-attachment locations.
Run integrity checks against the commit hash in use to confirm whether the deployment includes the 89c091ecf8b9f9c7291d1af0b1966e271f86551c patch.

Monitoring Recommendations

Enable filesystem auditing (auditd, EDR file telemetry) for the user account running the MCP server and review write events outside the attachments directory.
Forward MCP server stdout/stderr and request traces to a centralized log store and alert on Invalid save path errors that may indicate active probing.
Track outbound and inbound traffic to the MCP server endpoint, correlating tool invocations with file system activity.

How to Mitigate CVE-2026-10277

Immediate Actions Required

Update j3k0/mcp-google-workspace to a build that includes commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c or later.
Set the GMAIL_ATTACHMENTS_DIR environment variable to a dedicated, non-sensitive directory owned by the MCP server account.
Restrict who can reach the MCP server to trusted clients only, using network segmentation or authenticated transport.

Patch Information

The maintainer released the fix in commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c via pull request #22. The patch refactors attachment handling into src/tools/gmail-helpers.ts, introduces resolveAttachmentPath, and rejects unsafe path inputs. Because the project uses a rolling release model, no version tag is published; pin deployments to the patched commit hash or a later commit. References: GitHub Commit Details and GitHub Pull Request.

Workarounds

Run the MCP server under a low-privilege, dedicated OS user with no write access to sensitive system or home-directory paths.
Apply mandatory access controls (AppArmor, SELinux, or container filesystem mounts) that confine the Node.js process to the attachments directory.
Disable or remove the Gmail attachment save tool from the MCP server configuration until the patched commit is deployed.

bash

# Configuration example: confine attachment writes to a dedicated sandbox
export GMAIL_ATTACHMENTS_DIR="/var/lib/mcp-gsuite/attachments"
mkdir -p "$GMAIL_ATTACHMENTS_DIR"
chown mcp-gsuite:mcp-gsuite "$GMAIL_ATTACHMENTS_DIR"
chmod 700 "$GMAIL_ATTACHMENTS_DIR"

# Pin to the patched commit when installing from source
git clone https://github.com/j3k0/mcp-google-workspace.git
cd mcp-google-workspace
git checkout 89c091ecf8b9f9c7291d1af0b1966e271f86551c
npm ci && npm run build