---
id: "CVE-2026-61789"
kind: "vulnerability"
aliases: ["CVE-2026-61789"]
title: "DBHub MCP server: read-only check bypassed on MySQL and MariaDB"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "dbhub", "mariadb", "mcp", "mysql"]
not_affected_if: ["fixed-version", "postgresql-only", "read-only-database-account"]
published_at: "2026-10-30T17:17:26+00:00"
first_seen_at: "2026-10-30T17:31:39+00:00"
updated_at: "2026-10-30T17:32:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61789", "first_seen_at": "2026-10-30T17:31:39+00:00"}]
---

# DBHub MCP server: read-only check bypassed on MySQL and MariaDB

DBHub is a database server that lets AI assistants run SQL through the Model Context Protocol. On MySQL and MariaDB connections, a double dash followed by a non-space character hides a later write or DROP statement from the read-only validator, so the database still runs it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DBHub version with `npx dbhub --version` or in the package.json of the project that depends on it.
- Look for MySQL or MariaDB connectors in the DBHub configuration.
- Confirm whether the assistant can receive SQL from untrusted content, such as web pages or documents it reads.

## Fix

- DBHub: `0.22.6`

## Timeline

- 2026-10-30T17:31:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61789

## From the sources

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment` treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in `src/tools/execute-sql.ts` validates split statements with `isReadOnlySQL`, but `src/connectors/mysql/index.ts` and `src/connectors/mariadb/index.ts` execute the original string with `multipleStatements` enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_