CVE-2026-61788
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
DBHub prior to version 0.22.6 does not enforce read-only mode for the execute_sql tool even when readonly = true is set. The code that would enforce read-only is never executed, leaving only a simple classifier that checks the first keyword of each statement. This allows sequence tampering, arbitrary file writes, host file reads, and remote code execution. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default.
Risk Assessment
The organization is at risk of unauthorized database access, including data modification, data theft, and remote code execution on the server. Lack of authentication in HTTP transport increases the attack surface.
Recommendation
Upgrade DBHub to version 0.22.6 or later. Additionally, restrict access to the MCP server and enable authentication for HTTP transport.
Other vulnerabilities in DBHub
See all- CVE-2026-79536Critical
SQL injection vulnerability in dbhub v1.2.0 in the /utils/sql-parser.ts component. Attackers can access sensitive database information via crafted SQL statements.
- CVE-2026-61742Critical
DBHub, a database MCP server, in versions prior to 0.22.5 exposes an unauthenticated HTTP MCP endpoint when started in HTTP transport mode. Its protection based on comparing Origin and Host headers does not prevent DNS rebinding, allowing a malicious website to invoke MCP tools from the victim's browser. Depending on configuration, this can lead to reading, enumerating, and potentially writing database contents.
- CVE-2026-61789Medium
In DBHub prior to version 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. A double dash followed by a non-whitespace character can hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection, can bypass read-only mode to modify or drop database data.
Original NVD description (English source)
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS