{"uuid": "119c2613-eaeb-4e57-8ec5-12e7d6e6c2a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61742", "type": "seen", "source": "https://gist.github.com/alon710/578cc93d0032ecb85c4eb5d7e0d82616", "content": "# CVE-2026-61742: CVE-2026-61742: DNS Rebinding to Unauthenticated SQL Execution in DBHub\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61742\n\n## Summary\nA critical DNS rebinding vulnerability in DBHub (associated with GHSA-fm8p-53ww-hf6w) allows unauthenticated remote attackers to execute arbitrary SQL queries against local and internal databases. By exploiting a relative origin validation check within the HTTP transport middleware, an attacker can bypass same-origin protections via DNS rebinding. This allows malicious external websites to send JSON-RPC commands to the local DBHub service to read, write, and exfiltrate database contents. The issue affects all versions of DBHub prior to 0.22.5.\n\n## TL;DR\nUnauthenticated remote SQL execution on local DBHub database servers via client-side DNS rebinding.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-346\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 9.3\n- **EPSS Score**: N/A (Published 2026)\n- **Impact**: Unauthenticated arbitrary SQL Execution / Information Disclosure\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @bytebase/dbhub\n- DBHub Server (HTTP transport mode)\n- **@bytebase/dbhub**: < 0.22.5 (Fixed in: `0.22.5`)\n\n## Mitigation\n\n- Upgrade DBHub to version 0.22.5 or above to apply strict host allowlisting.\n- Restrict service binding explicitly to loopback interface 127.0.0.1 instead of wildcard interfaces 0.0.0.0.\n- Deploy a reverse proxy (e.g., Nginx, Apache, or Caddy) in front of the HTTP endpoint to enforce authentication and validate host headers.\n\n**Remediation Steps:**\n1. Run 'npm install @bytebase/dbhub@latest' to update the package dependency.\n2. Verify the version is at least 0.22.5 by inspecting the package-lock.json or running 'npx @bytebase/dbhub --version'.\n3. If configuration overrides are needed, pass the authorized domain names via the '--allowed-hosts' CLI argument or the 'DBHUB_ALLOWED_HOSTS' environment variable.\n\n## References\n\n- [GitHub Security Advisory GHSA-fm8p-53ww-hf6w](https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w)\n- [NVD CVE-2026-61742 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-61742)\n- [DBHub v0.22.6 Release Notes](https://github.com/bytebase/dbhub/releases/tag/v0.22.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61742) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T13:30:32.000000Z"}