CVE-2026-10277: Improper Access Control in MCP Google Workspace Gmail Tool

Technical summary

CVE-2026-10277 is an improper access control vulnerability in the saveToDisk function within src/tools/gmail.ts of the j3k0 mcp-google-workspace project. The flaw stems from insufficient authorization checks (CWE-266, CWE-284) that permit authenticated attackers to manipulate file storage operations and access data beyond their intended permissions. The vulnerability requires valid credentials (PR:L) but no additional interaction (UI:N), making it exploitable through network access (AV:N) with straightforward exploitation complexity (AC:L). This rolling-release project tracks fixes by commit hash rather than version numbers.

Business impact

Organizations deploying the MCP Google Workspace Gmail integration face potential data leakage and unauthorized file manipulation by internal or compromised users. Since exploitation requires authentication, the primary risk involves privilege escalation or lateral movement by existing account holders. For teams using this integration to manage Gmail workflows or archive sensitive messages, the vulnerability could expose business communications, customer data, or internal records to unauthorized viewing or modification.

Affected systems

The j3k0 mcp-google-workspace project up to commit 831790e7d5c2663325733d9f5579cc339a267c4c is affected. Because this project uses continuous rolling releases without traditional version numbering, all deployments using code before commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c (the patched commit) require remediation. Verify your current commit hash against these values to determine exposure status.

Exploitability

The exploit is actively public. An attacker needs valid authentication credentials to the system and network access to the MCP Google Workspace endpoint—both typically available to employees or compromised user accounts. No special privileges are required beyond basic authenticated access, and the attack requires no user interaction. This combination of public disclosure, low complexity, and authentication-only barrier creates moderate exploitability risk, particularly in environments with large user bases or third-party integrations.

Remediation

Update the mcp-google-workspace project to commit 89c091ecf8b9f9c7291d1af0b1966e271f86551c or later. Given the rolling-release model, pull the latest main branch code and verify the commit hash. If your deployment pins to a specific commit, explicitly update to the patched commit or newer. Test the integration in a non-production environment before deploying to production Gmail workflows.

Patch guidance

Since this project lacks traditional version releases, patching requires a commit-based approach. Identify your currently deployed commit hash (typically visible in your package.json lock file or installed package metadata). Compare it against the vulnerable commit (831790e7d5c2663325733d9f5579cc339a267c4c). If equal or earlier, pull the latest code and verify the patched commit (89c091ecf8b9f9c7291d1af0b1966e271f86551c) is included. Update your dependency lock file and redeploy. Consult the project's repository changelog to confirm no breaking changes accompany the patch.

Detection guidance

Monitor saveToDisk function calls in src/tools/gmail.ts logs for unusual file paths, permissions, or user access patterns. Alert on cases where authenticated users access or write files outside their expected scope. Review Gmail API audit logs within the Google Workspace admin console for unexpected file export or attachment operations. Implement network-level monitoring on MCP Google Workspace service traffic for anomalous access control bypasses. Correlate user authentication timestamps with file manipulation events to identify suspicious timing or account abuse.

Why prioritize this

This vulnerability merits prompt but measured attention. The CVSS 6.3 MEDIUM score reflects its authentication requirement, yet the public exploit, straightforward exploitation, and potential for unauthorized access to sensitive business communications justify near-term patching. Organizations should prioritize this within 2–4 weeks, earlier if users with Gmail integration access handle sensitive data or if your environment has elevated insider risk.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a network-accessible vulnerability requiring low-level authentication, no user interaction, and low attack complexity. Impact is limited to confidentiality, integrity, and availability on the affected system (not enterprise-wide). The score does not weight the public exploit status or the sensitive nature of Gmail data, so organizations should consider context-specific aggravation factors, such as data classification or compliance obligations around email communications.

Frequently asked questions