Live › vulnerability › CVE-2026-85788
Go to dashboardThe awslabs mysql-mcp-server, a self-hosted MCP server for MySQL, can have its read-only check circumvented using SQL inline comments. A statement the read-only check was meant to block can run against the database, within the privileges of the configured MySQL user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.
Teams running the self-hosted awslabs.mysql-mcp-server at version 1.0.21 or earlier, where the MCP server connects to MySQL with a user that can perform writes or other sensitive actions. AWS states the read-only mode is best-effort and the real boundary is the database user's permissions, so setups where that user is already tightly scoped carry less risk. Teams not using this package can skip it.
No product ranges from the sources yet.
pip show awslabs.mysql-mcp-server and look at the Version line; affected versions are 1.0.21 and below.pip install --upgrade awslabs.mysql-mcp-server to 1.0.23 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
Bulletin ID: 2026-103-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 09:15 PM PDT
Description:
We identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain conditions the read-only enforcement could be circumvented via SQL inline comments, allowing a statement to run that the read-only check was expected to block. The read-only mode provided by the server is a best-effort safeguard and is not a substitute for correctly scoped database permissions; the effective boundary is the permissions of the configured MySQL user.
This issue does not affect the confidentiality or integrity of any AWS service. awslabs.mysql-mcp-server is a client-side, self-managed package; customers control installation and the privileges of the database credentials they configure.
Affected versions: awslabs.mysql-mcp-server ≤ 1.0.21
Resolution:
The issue is addressed in awslabs.mysql-mcp-server 1.0.23. We recommend customers upgrade to 1.0.23 or later:
pip install --upgrade awslabs.mysql-mcp-server
As defense in depth, ensure the database user configured for the MCP server is granted only the minimum privileges required, and does not hold the FILE privilege unless explicitly needed.
Workarounds:
None.
References:
Acknowledgement:
We would like to thank Jaeyoung Yun for reporting this issue and working with us as part of our coordinated disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-85788")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.