{"metadata": {"vulnerability": "CVE-2026-61789", "count": 16, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-07-10T20:06:05.616Z", "date_only": false, "value": "2026-07-10T20:06:05.616Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61789", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T16:08:24.224Z", "date_only": false, "value": "2026-10-30T16:08:24.224Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61789", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T16:08:24.224Z", "date_only": false, "value": "2026-10-30T16:08:24.224Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61789", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T16:27:52.167Z", "date_only": false, "value": "2026-10-30T16:27:52.167256Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117530799092086501", "record": "CVE-2026-61789", "field": "creation_timestamp", "uuid": "ed5265ef-62f4-4c72-95c9-5c0c3907b02e", "content": "CVE-2026-61789 DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in `src/tools/execute-sql.ts` validates split statements with `isReadOnlySQL`, but `src/connectors/mysql/index.ts` and `src/connectors/mariadb/index.ts` execute the original string with `multipleStatements` enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61789https://github.com/bytebase/dbhub/security/advisories/GHSA-j656-3hf2-fvjchttps://github.com/bytebase/dbhub/pull/342https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08https://github.com/bytebase/dbhub/releases/tag/v0.22.6#bytebase #dbhub#CVE_2026_61789#bot", "url": "https://infosec.exchange/users/cve/statuses/117530799092086501"}, {"timestamp": "2026-10-30T17:17:26Z", "date_only": false, "value": "2026-10-30T17:17:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J55Q-P8QC-F6WG", "record": "GHSA-J55Q-P8QC-F6WG", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-30T17:17:26.743Z", "date_only": false, "value": "2026-10-30T17:17:26.743", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61789", "record": "FKIE_CVE-2026-61789", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T18:32:42Z", "date_only": false, "value": "2026-10-30T18:32:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J55Q-P8QC-F6WG", "record": "GHSA-J55Q-P8QC-F6WG", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T18:32:42Z", "date_only": false, "value": "2026-10-30T18:32:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J55Q-P8QC-F6WG", "record": "GHSA-J55Q-P8QC-F6WG", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T15:10:04.553Z", "date_only": false, "value": "2026-10-31T15:10:04.553221Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz6lbeqnum2y", "record": "CVE-2026-61789", "field": "creation_timestamp", "uuid": "452efab2-9b02-49f1-ab4b-1c67981aaef5", "content": "CVE-2026-61789\nThe DBHub server\u2019s MySQL and MariaDB connectors could be tricked into running write commands even when the system is set to read\u2011only. By using a double\u2011dash comment that does not follow the expected spacing,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz6lbeqnum2y"}, {"timestamp": "2026-11-02T17:57:51Z", "date_only": false, "value": "2026-11-02T17:57:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J656-3HF2-FVJC", "record": "GHSA-J656-3HF2-FVJC", "field": "published", "linked_record": true}, {"timestamp": "2026-11-02T17:57:51Z", "date_only": false, "value": "2026-11-02T17:57:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J656-3HF2-FVJC", "record": "GHSA-J656-3HF2-FVJC", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-06T16:25:08.918Z", "date_only": false, "value": "2026-11-06T16:25:08.918290Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61789", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-06T16:25:08.918Z", "date_only": false, "value": "2026-11-06T16:25:08.918290Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61789", "record": "FKIE_CVE-2026-61789", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-06T16:25:27.915Z", "date_only": false, "value": "2026-11-06T16:25:27.915Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61789", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-06T16:25:27.915Z", "date_only": false, "value": "2026-11-06T16:25:27.915Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-61789", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-06T17:18:32.840Z", "date_only": false, "value": "2026-11-06T17:18:32.840", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61789", "record": "FKIE_CVE-2026-61789", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T15:31:39.321Z", "anchors": {"origin": {"timestamp": "2026-10-30T16:08:24.224Z", "date_only": false, "value": "2026-10-30T16:08:24.224Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61789", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T16:08:24.224Z", "date_only": false, "value": "2026-10-30T16:08:24.224Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61789", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1207395.097659, "hours": 335.3875271275, "days": 13.974480296979166, "min_seconds": 1207395.097659, "max_seconds": 1207395.097659, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T16:08:24.224Z", "date_only": false, "value": "2026-10-30T16:08:24.224Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61789", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T15:31:39.321Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}