Vulnerability-Lookup

GHSA-RQFV-2MW9-78G2

Vulnerability from github – Published: 2026-09-11 20:35 – Updated: 2026-09-11 20:35

Summary

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Details

Summary

In SSE/HTTP transport mode, mysql_mcp_server constructs SseServerTransport without passing security_settings. As a result, the MCP Python SDK's DNS-rebinding protection (Origin/Host header validation) is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service binds to 0.0.0.0 by default with no authentication on any route.

Trigger condition: MCP_TRANSPORT=sse. The default stdio mode is not affected.

Attack Scenarios

Scenario A — Direct exposure: Any network attacker can invoke execute_sql to run arbitrary SQL without credentials → full data dump, and via MySQL FILE privileges, arbitrary file read/write and RCE.

Scenario B — DNS rebinding (local bind): An attacker lures a victim's browser to a malicious page, rebinds their domain to 127.0.0.1, and uses the browser as a proxy to invoke execute_sql as same-origin.

Root Cause

In src/mysql_mcp_server/server.py:

SseServerTransport is constructed without security_settings — the SDK defaults enable_dns_rebinding_protection to False.
The Starlette app has no CORS or TrustedHost middleware.
All three routes (/, /sse, /messages/) are unauthenticated.
The service binds to 0.0.0.0 by default.
The sink is cursor.execute(query) with a fully attacker-controlled query.

Impact

Unauthenticated arbitrary SQL execution against the configured database
Full data exfiltration and modification
If the MySQL account holds FILE privilege: arbitrary file read (LOAD_FILE) and write (INTO OUTFILE) — potential RCE via webshell drop
Internet-wide scanning has identified 25 publicly reachable SSE instances of this project

Fix

Released in v0.4.2: DNS-rebinding protection is now enabled by passing TransportSecuritySettings(enable_dns_rebinding_protection=True) to SseServerTransport, and the documented recommended bind address is 127.0.0.1.

Credits

Discovered by Huanchen, SongWu (JHU), and BrookeYangRui (JHU).

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mysql-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59971"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T20:35:42Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nIn SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_settings`. As a result, the MCP Python SDK\u0027s DNS-rebinding protection (Origin/Host header validation) is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service binds to `0.0.0.0` by default with no authentication on any route.\n\n**Trigger condition:** `MCP_TRANSPORT=sse`. The default stdio mode is not affected.\n\n## Attack Scenarios\n\n**Scenario A \u2014 Direct exposure:** Any network attacker can invoke `execute_sql` to run arbitrary SQL without credentials \u2192 full data dump, and via MySQL `FILE` privileges, arbitrary file read/write and RCE.\n\n**Scenario B \u2014 DNS rebinding (local bind):** An attacker lures a victim\u0027s browser to a malicious page, rebinds their domain to `127.0.0.1`, and uses the browser as a proxy to invoke `execute_sql` as same-origin.\n\n## Root Cause\n\nIn `src/mysql_mcp_server/server.py`:\n\n1. `SseServerTransport` is constructed without `security_settings` \u2014 the SDK defaults `enable_dns_rebinding_protection` to `False`.\n2. The Starlette app has no CORS or TrustedHost middleware.\n3. All three routes (`/`, `/sse`, `/messages/`) are unauthenticated.\n4. The service binds to `0.0.0.0` by default.\n5. The sink is `cursor.execute(query)` with a fully attacker-controlled query.\n\n## Impact\n\n- Unauthenticated arbitrary SQL execution against the configured database\n- Full data exfiltration and modification\n- If the MySQL account holds `FILE` privilege: arbitrary file read (`LOAD_FILE`) and write (`INTO OUTFILE`) \u2014 potential RCE via webshell drop\n- Internet-wide scanning has identified 25 publicly reachable SSE instances of this project\n\n## Fix\n\nReleased in v0.4.2: DNS-rebinding protection is now enabled by passing `TransportSecuritySettings(enable_dns_rebinding_protection=True)` to `SseServerTransport`, and the documented recommended bind address is `127.0.0.1`.\n\n## Credits\n\nDiscovered by Huanchen, SongWu (JHU), and BrookeYangRui (JHU).",
  "id": "GHSA-rqfv-2mw9-78g2",
  "modified": "2026-09-11T20:35:42Z",
  "published": "2026-09-11T20:35:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/designcomputer/mysql_mcp_server/issues/92"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/designcomputer/mysql_mcp_server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.4.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)"
}

CVE-2026-59971 (GCVE-0-2026-59971)

Vulnerability from cvelistv5 – Published: 2026-09-15 14:10 – Updated: 2026-09-15 15:08

Title

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Summary

MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 15:07 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-346 - Origin Validation Error

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/designcomputer/mysql_mcp_serve…	x_refsource_CONFIRM
https://github.com/designcomputer/mysql_mcp_serve…	x_refsource_MISC
https://github.com/designcomputer/mysql_mcp_serve…	x_refsource_MISC
https://github.com/designcomputer/mysql_mcp_serve…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
designcomputer	mysql_mcp_server	Affected: < 0.4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T15:07:25.603382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T15:08:40.961Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mysql_mcp_server",
          "vendor": "designcomputer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim\u0027s browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:10:28.116Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2"
        },
        {
          "name": "https://github.com/designcomputer/mysql_mcp_server/issues/92",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/designcomputer/mysql_mcp_server/issues/92"
        },
        {
          "name": "https://github.com/designcomputer/mysql_mcp_server/commit/a96549f4a4d65443fd6e9c7f2324fba9a5c80a82",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/designcomputer/mysql_mcp_server/commit/a96549f4a4d65443fd6e9c7f2324fba9a5c80a82"
        },
        {
          "name": "https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.4.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.4.2"
        }
      ],
      "source": {
        "advisory": "GHSA-rqfv-2mw9-78g2",
        "discovery": "UNKNOWN"
      },
      "title": "MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59971",
    "datePublished": "2026-09-15T14:10:28.116Z",
    "dateReserved": "2026-07-07T19:41:00.003Z",
    "dateUpdated": "2026-09-15T15:08:40.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-RQFV-2MW9-78G2

Summary

Attack Scenarios

Root Cause

Impact

Fix

Credits

CVE-2026-59971 (GCVE-0-2026-59971)

Tags

Sightings

Nomenclature