Live › vulnerability › GHSA-x25m-ph3m-3r9q
Go to dashboardThe awslabs mysql-mcp-server, a Model Context Protocol server for MySQL, could be tricked by SQL inline comments into running a statement its read-only check was meant to block. An attacker who can send queries through the server can write or change data the read-only mode was supposed to protect.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC. All times on this page are UTC.
Teams that self-host awslabs.mysql-mcp-server at version 1.0.21 or earlier and connect it to a MySQL database. The read-only mode is a best-effort safeguard, so the real boundary is the privileges of the configured database user. Teams not running this package, or running it at 1.0.23 or later, can skip it.
No product ranges from the sources yet.
pip show awslabs.mysql-mcp-server; versions 1.0.21 and earlier are affected.SHOW GRANTS FOR 'mcp_user'@'%';.awslabs.mysql-mcp-server 1.0.23 or later with pip install --upgrade awslabs.mysql-mcp-server.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-85788 - Issue with awslabs mysql-mcp-server
Bulletin ID: 2026-103-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 09:15 PM PDT
Description:
We identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain conditions the read-only enforcement could be circumvented via SQL inline comments, allowing a statement to run that the read-only check was expected to block. The read-only mode provided by the server is a best-effort safeguard and is not a substitute for correctly scoped database permissions; the effective boundary is the permissions of the configured MySQL user.
This issue does not affect the confidentiality or integrity of any AWS service. awslabs.mysql-mcp-server is a client-side, self-managed package; customers control installation and the privileges of the database credentials they configure.
Affected versions: awslabs.mysql-mcp-server ≤ 1.0.21
Resolution:
The issue is addressed in awslabs.mysql-mcp-server 1.0.23. We recommend customers upgrade to 1.0.23 or later:
pip install --upgrade awslabs.mysql-mcp-server
As defense in depth, ensure the database user configured for the MCP server is granted only the minimum privileges required, and does not hold the FILE privilege unless explicitly needed.
Workarounds:
None.
References:
Acknowledgement:
We would like to thank Jaeyoung Yun for reporting this issue and working with us as part of our coordinated disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-x25m-ph3m-3r9q")