CVE-2026-15829

CVE-2026-15829 affects googleapis/mcp-toolbox (bigquery-forecast). The prebuilt forecasting tool interpolates client-controlled parameters (data_col, timestamp_col, id_cols) into a generated AI.FORECAST query via fmt.Sprintf without re-validation, enabling SQL injection (CWE-89) and a security bo...

PT-2026-61987

Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox affected versions not specified Description A SQL injection and security boundary bypass issue exists in the prebuilt BigQuery forecasting tool bigquery-forecast. The tool accepts client-controlled parameters data col,...