Live › vulnerability › CVE-2026-61789
DBHub is a database server that lets AI assistants run SQL through the Model Context Protocol. On MySQL and MariaDB connections, a double dash followed by a non-space character hides a later write or DROP statement from the read-only validator, so the database still runs it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Teams that run DBHub with MySQL or MariaDB connections and rely on its read-only mode to limit an AI assistant. PostgreSQL connections are not affected through this path, according to the description. The attack needs the assistant to be steered into sending SQL, for example by prompt injection in content it reads, and the damage is limited by the database account's privileges.
No product ranges from the sources yet.
npx dbhub --version or in the package.json of the project that depends on it.0.22.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in src/tools/execute-sql.ts validates split statements with isReadOnlySQL, but src/connectors/mysql/index.ts and src/connectors/mariadb/index.ts execute the original string with multipleStatements enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-61789")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.