{"uuid": "8a4dfed9-2a0a-4e91-bf9c-141bb39f3b80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61788", "type": "seen", "source": "https://gist.github.com/alon710/dc5aa94f453805ed82e51ccb8dad1bc3", "content": "# CVE-2026-61788: CVE-2026-61788: Read-Only Bypass in DBHub Database Model Context Protocol Server\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61788\n\n## Summary\nCVE-2026-61788 identifies a critical vulnerability in DBHub, an open-source database Model Context Protocol (MCP) server designed to manage and interact with database engines including PostgreSQL, MySQL, SQL Server, Oracle, MariaDB, and SQLite. Prior to version 0.22.6, DBHub fails to securely enforce its declared 'readonly' execution mode. Unauthenticated remote attackers can bypass keyword-based filters and transaction controls to execute arbitrary write operations, manipulate database sequences, read or write files on the host operating system, and potentially execute arbitrary system commands.\n\n## TL;DR\nDBHub versions prior to 0.22.6 fail to enforce read-only execution constraints. Attackers can execute arbitrary SQL write operations, modify host files, and run commands by exploiting unauthenticated access to the default /mcp endpoint combined with parser-specific string bypasses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-184 / CWE-636 / CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.4\n- **Exploit Status**: poc\n- **CISA KEV Status**: No\n- **Affected Component**: DBHub Connection Manager & Query Parser\n- **Impact**: Incorrect Authorization (Read-Only Policy Bypass)\n\n## Affected Systems\n\n- DBHub Model Context Protocol (MCP) Server\n- **@bytebase/dbhub**: < 0.22.6 (Fixed in: `0.22.6`)\n\n## Mitigation\n\n- Upgrade DBHub to version 0.22.6 or higher to enable native transaction-level read-only locks.\n- Bind DBHub to localhost (127.0.0.1) instead of the wildcard address (0.0.0.0) to prevent external exposure.\n- Use host-based firewalls or network access control lists to restrict access to the /mcp endpoint.\n- Enforce the Principle of Least Privilege (PoLP) on the database accounts connected to DBHub.\n\n**Remediation Steps:**\n1. Check the running version of @bytebase/dbhub in your npm or deployment environment.\n2. If the version is less than 0.22.6, execute an upgrade command, such as npm install @bytebase/dbhub@0.22.6.\n3. Locate the configuration file or startup script and ensure the server listening parameter is set to 127.0.0.1.\n4. Modify the user permissions of database engines managed by DBHub, revoking direct write access from credentials used for general analysis.\n\n## References\n\n- [GitHub Security Advisory GHSA-mwwr-p57h-56pf](https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf)\n- [Fix Commit 872bb33](https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08)\n- [NVD Vulnerability Detail - CVE-2026-61788](https://nvd.nist.gov/vuln/detail/CVE-2026-61788)\n- [CVE.org Record - CVE-2026-61788](https://www.cve.org/CVERecord?id=CVE-2026-61788)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61788) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T12:30:32.000000Z"}