---
id: "CVE-2026-85788"
kind: "vulnerability"
aliases: ["CVE-2026-85788"]
title: "AWS mysql-mcp-server: SQL inline comments bypass read-only mode checks"
severity: "medium"
cvss: 5.7
epss: 0.00184
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "aws", "lab-disclosure", "mcp", "mysql", "python", "self-hosted"]
not_affected_if: ["read-only-database-user", "version-1.0.23-or-later"]
published_at: "2026-09-09T00:00:00+00:00"
first_seen_at: "2026-10-24T18:43:45+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85788", "first_seen_at": "2026-10-24T18:53:56+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85788", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# AWS mysql-mcp-server: SQL inline comments bypass read-only mode checks

The awslabs mysql-mcp-server, a self-hosted MCP server for MySQL, can have its read-only check circumvented using SQL inline comments. A statement the read-only check was meant to block can run against the database, within the privileges of the configured MySQL user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pip show awslabs.mysql-mcp-server` and look at the Version line; affected versions are `1.0.21` and below.
- Check the database user the MCP server connects with and confirm it lacks the FILE privilege and other unneeded grants.

## Fix

- Upgrade the package: `pip install --upgrade awslabs.mysql-mcp-server` to `1.0.23` or later.
- Grant the MCP server's MySQL user only the minimum privileges required, without the FILE privilege unless explicitly needed.

## Timeline

- 2026-10-24T18:43:45+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/ — AWS: CVE-2026-85788 - Issue with awslabs mysql-mcp-server
- 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85788
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85788

## Documents

- [advisory] AWS: CVE-2026-85788 - Issue with awslabs mysql-mcp-server https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/

## From the sources

CVE-2026-85788 - Issue with awslabs mysql-mcp-server

### CVE-2026-85788 - Issue with awslabs mysql-mcp-server

Bulletin ID: 2026-103-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 09:15 PM PDT

Description:

We identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain conditions the read-only enforcement could be circumvented via SQL inline comments, allowing a statement to run that the read-only check was expected to block. The read-only mode provided by the server is a best-effort safeguard and is not a substitute for correctly scoped database permissions; the effective boundary is the permissions of the configured MySQL user.

This issue does not affect the confidentiality or integrity of any AWS service. awslabs.mysql-mcp-server is a client-side, self-managed package; customers control installation and the privileges of the database credentials they configure.

Affected versions: awslabs.mysql-mcp-server ≤ 1.0.21

Resolution:

The issue is addressed in awslabs.mysql-mcp-server 1.0.23. We recommend customers upgrade to 1.0.23 or later:

 pip install --upgrade awslabs.mysql-mcp-server

As defense in depth, ensure the database user configured for the MCP server is granted only the minimum privileges required, and does not hold the FILE privilege unless explicitly needed.

Workarounds:

None.

References:

- CVE-2026-85788
- GHSA-x25m-ph3m-3r9q

Acknowledgement:

We would like to thank Jaeyoung Yun for reporting this issue and working with us as part of our coordinated disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_