CVE-2026-15829: BigQuery Forecasting Tool SQLi Vulnerability

CVE-2026-15829 Overview

CVE-2026-15829 is a SQL injection [CWE-89] and authorization bypass [CWE-863] vulnerability in the prebuilt BigQuery forecasting tool (bigquery-forecast) of the googleapis/mcp-toolbox project. The tool interpolates client-supplied parameters directly into a generated AI.FORECAST table-valued SELECT statement without escaping. An authenticated attacker can break out of the string literal fields and inject a cross-dataset query block. This allows the attacker to bypass the operator-configured allowedDatasets boundary and read arbitrary BigQuery tables.

Critical Impact
Attackers with low privileges can exfiltrate BigQuery data from datasets outside the configured allow list, breaking a documented security boundary of MCP Toolbox.

Affected Products

googleapis/mcp-toolbox — prebuilt bigquery-forecast tool
Google BigQuery deployments exposed through MCP Toolbox with allowedDatasets configured
Model Context Protocol (MCP) integrations relying on MCP Toolbox for data access mediation

Discovery Timeline

2026-07-21 - CVE-2026-15829 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15829

Vulnerability Analysis

The bigquery-forecast tool accepts three client-controlled parameters as plain strings: data_col, timestamp_col, and id_cols. It passes these directly into fmt.Sprintf to assemble an AI.FORECAST query. Because the values are not escaped or validated as identifiers, an attacker can close a string literal and append arbitrary SQL. The generated query then executes against BigQuery with the credentials of the MCP Toolbox service.

MCP Toolbox implements an allowedDatasets mechanism intended to restrict which BigQuery datasets a client can query. That control validates the history_data parameter but does not re-validate the final assembled query. As a result, injected identifiers referencing datasets outside the allow list are executed without further checks.

The issue is a combination of unsafe string interpolation and incomplete authorization enforcement [CWE-863]. The vulnerability requires low privileges and no user interaction, and is reachable over the network through the MCP interface.

Root Cause

The root cause is direct string concatenation of untrusted identifiers into a SQL query using fmt.Sprintf. BigQuery identifiers require parameterized handling or strict allow-list validation. The allowedDatasets check is applied only to a single parameter, leaving other parameters as an unvalidated injection surface.

Attack Vector

An attacker submits a forecast request that supplies a crafted value for timestamp_col (or data_col / id_cols) containing a backtick or quote sequence that terminates the intended identifier. The remainder of the injected payload appends a multi-statement or cross-dataset SELECT referencing tables outside allowedDatasets. When MCP Toolbox executes the assembled query, BigQuery returns rows from the attacker-chosen table. Refer to the GitHub Pull Request for the patch details and the exact injection points.

Detection Methods for CVE-2026-15829

Indicators of Compromise

BigQuery audit log entries showing queries that reference datasets outside the configured allowedDatasets set, issued by the MCP Toolbox service account.
AI.FORECAST queries where timestamp_col, data_col, or id_cols contain backticks, quotes, parentheses, or SQL keywords such as SELECT, UNION, or FROM.
Unusually large or unexpected jobs.query events originating from the MCP Toolbox host during forecasting requests.

Detection Strategies

Enable BigQuery Data Access audit logs and alert on read operations against tables not present in the allowedDatasets configuration.
Inspect MCP Toolbox request logs for forecast tool invocations whose column parameters fail a strict identifier regex such as ^[A-Za-z_][A-Za-z0-9_]*$.
Correlate MCP Toolbox request identifiers with BigQuery job history to detect drift between requested and executed datasets.

Monitoring Recommendations

Forward BigQuery audit logs and MCP Toolbox application logs to a centralized analytics platform for retention and query.
Baseline forecast tool usage by dataset and column pattern, then alert on outliers such as previously unseen table references.
Monitor the MCP Toolbox service account for token usage spikes or queries returning volumes inconsistent with forecasting workloads.

How to Mitigate CVE-2026-15829

Immediate Actions Required

Upgrade googleapis/mcp-toolbox to a version that includes the fix from GitHub Pull Request 3324.
Disable the bigquery-forecast prebuilt tool in MCP Toolbox configurations until the patched build is deployed.
Rotate the BigQuery service account credentials used by MCP Toolbox and review its IAM grants to enforce least privilege.
Audit BigQuery access logs for the past 90 days for queries referencing datasets outside the operator-configured allow list.

Patch Information

The upstream fix is tracked in googleapis/mcp-toolbox Pull Request 3324. The patch validates the data_col, timestamp_col, and id_cols parameters as safe BigQuery identifiers before interpolation and applies the allowedDatasets check to the final assembled query. Deploy the patched release and restart the MCP Toolbox service.

Workarounds

Remove or comment out the bigquery-forecast tool from the MCP Toolbox tools.yaml configuration to eliminate the vulnerable code path.
Restrict the BigQuery service account IAM binding to a single dataset so that injected cross-dataset queries fail at the authorization layer.
Place MCP Toolbox behind an authenticating proxy that rejects requests whose forecast parameters do not match a strict identifier allow list.

bash

# Configuration example: restrict BigQuery service account to a single dataset
# and remove the vulnerable tool until patching is complete

# 1) Grant dataViewer only on the intended dataset
bq add-iam-policy-binding \
  --member="serviceAccount:mcp-toolbox@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/bigquery.dataViewer" \
  PROJECT_ID:allowed_dataset

# 2) Disable the vulnerable tool in tools.yaml
# tools:
#   bigquery-forecast:
#     enabled: false