{"id":"CVE-2026-61789","kind":"vulnerability","aliases":["CVE-2026-61789"],"related":[],"title":"DBHub MCP server: read-only check bypassed on MySQL and MariaDB","description":"DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in `src/tools/execute-sql.ts` validates split statements with `isReadOnlySQL`, but `src/connectors/mysql/index.ts` and `src/connectors/mariadb/index.ts` execute the original string with `multipleStatements` enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.","summary":"DBHub is a database server that lets AI assistants run SQL through the Model Context Protocol. On MySQL and MariaDB connections, a double dash followed by a non-space character hides a later write or DROP statement from the read-only validator, so the database still runs it.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","dbhub","mariadb","mcp","mysql"],"not_affected_if":["fixed-version","postgresql-only","read-only-database-account"],"how_to_check":"- Check the installed DBHub version with `npx dbhub --version` or in the package.json of the project that depends on it.\n- Look for MySQL or MariaDB connectors in the DBHub configuration.\n- Confirm whether the assistant can receive SQL from untrusted content, such as web pages or documents it reads.","fix":"- DBHub: `0.22.6`","status":"open","published_at":"2026-10-30T17:17:26+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:11+00:00","updated_at":"2026-10-30T17:32:11+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-30T17:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- DBHub: `0.22.6`","reach":"unknown","title":"DBHub MCP server: read-only check bypassed on MySQL and MariaDB","impact":"high","summary":"DBHub is a database server that lets AI assistants run SQL through the Model Context Protocol. On MySQL and MariaDB connections, a double dash followed by a non-space character hides a later write or DROP statement from the read-only validator, so the database still runs it.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["dbhub","mcp","mysql","mariadb","ai-agents"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"assistant-issued writes or DDL alter or drop database data","analyst_note":"","how_to_check":"- Check the installed DBHub version with `npx dbhub --version` or in the package.json of the project that depends on it.\n- Look for MySQL or MariaDB connectors in the DBHub configuration.\n- Confirm whether the assistant can receive SQL from untrusted content, such as web pages or documents it reads.","plain_action":"","needs_analyst":false,"not_affected_if":["postgresql-only","read-only-database-account","fixed-version"],"who_is_affected":"Teams that run DBHub with MySQL or MariaDB connections and rely on its read-only mode to limit an AI assistant. PostgreSQL connections are not affected through this path, according to the description. The attack needs the assistant to be steered into sending SQL, for example by prompt injection in content it reads, and the damage is limited by the database account's privileges.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4461,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61789':15A,18A '0.22.6':94C,261C 'abl':196C 'account':228C 'affect':234C 'agent':21B 'agre':244C 'ai':20B,23B,36B 'ai-ag':19B 'ai-tool':22B 'anyon':195C 'assist':37B,200C,210C 'bypass':8A,102C,213C 'charact':59B,129C,168C 'check':7A,140C 'checker':247C 'comment':118C 'connect':49B 'connector':108C,250C 'content':208C 'context':43B 'control':128C 'cve':13A,16A 'dash':52B,115C,161C,187C,242C 'data':223C 'databas':32B,75B,81C,184C,222C,227C 'dbhub':1A,25B,29B,78C 'ddl':177C 'destruct':176C 'doubl':51B,114C,160C,241C 'double-dash':240C 'drop':65B,221C 'enabl':158C 'end':132C 'everi':113C 'execut':152C,192C,251C 'fix':258C 'follow':53B,125C,162C 'hide':60B,171C 'includ':203C 'individu':252C 'influenc':198C 'inject':206C 'interpret':185C 'isreadonlysql':147C 'issu':256C 'later':62B 'let':35B 'line':135C 'mariadb':12A,26B,48B,90C,107C,123C 'mcp':2A,27B,82C 'minus':189C 'mode':217C 'model':42B 'modifi':219C 'multiplestat':157C 'mysql':10A,28B,46B,86C,105C,121C 'non':57B,166C 'non-spac':56B 'non-whitespac':165C 'oper':190C 'oracl':89C 'origin':154C 'pars':243C 'path':237C 'postgr':85C 'postgresql':231C 'prior':92C 'privileg':230C 'prompt':205C 'protocol':44B 'read':5A,70B,96C,138C,211C,215C 'read-on':4A,69B,95C,137C,214C 'requir':124C 'run':38B,77B 'scansinglelinecom':111C 'server':3A,33B,83C,88C 'space':58B 'split':144C,253C 'sql':39B,87C,98C,202C 'sqlite':91C 'src/connectors/mariadb/index.ts':151C 'src/connectors/mysql/index.ts':149C 'src/tools/execute-sql.ts':142C 'src/utils/sql-parser.ts':110C 'start':119C 'statement':66B,145C,178C,194C,254C 'still':76B 'string':155C 'subject':224C 'subsequ':173C 'therefor':170C 'tool':24B 'treat':112C 'valid':72B,99C,143C,181C 'version':260C 'wherea':120C 'whitespac':126C,167C 'write':63B,174C","nicknames":[],"mitigations":[],"who_affected":"Teams that run DBHub with MySQL or MariaDB connections and rely on its read-only mode to limit an AI assistant. PostgreSQL connections are not affected through this path, according to the description. The attack needs the assistant to be steered into sending SQL, for example by prompt injection in content it reads, and the damage is limited by the database account's privileges.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61789","severity":null,"published_at":"2026-10-30T17:17:26+00:00","modified_at":"2026-10-30T17:17:26+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}