CVE-2026-61742
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
DBHub, a database MCP server, in versions prior to 0.22.5 exposes an unauthenticated HTTP MCP endpoint when started in HTTP transport mode. Its protection based on comparing Origin and Host headers does not prevent DNS rebinding, allowing a malicious website to invoke MCP tools from the victim's browser. Depending on configuration, this can lead to reading, enumerating, and potentially writing database contents.
Risk Assessment
An attacker can perform database operations without authentication via the victim's browser, risking data leakage or modification. The risk is especially high with real databases and broad MCP tool permissions.
Recommendation
Update DBHub to version 0.22.5 or later. Restrict network access to the HTTP MCP endpoint and apply least privilege to database credentials.
Other vulnerabilities in DBHub
See all- CVE-2026-79536Critical
SQL injection vulnerability in dbhub v1.2.0 in the /utils/sql-parser.ts component. Attackers can access sensitive database information via crafted SQL statements.
- CVE-2026-61789Medium
In DBHub prior to version 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. A double dash followed by a non-whitespace character can hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection, can bypass read-only mode to modify or drop database data.
- CVE-2026-61788High
DBHub prior to version 0.22.6 does not enforce read-only mode for the execute_sql tool even when readonly = true is set. The code that would enforce read-only is never executed, leaving only a simple classifier that checks the first keyword of each statement. This allows sequence tampering, arbitrary file writes, host file reads, and remote code execution. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default.
Original NVD description (English source)
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS