{"id":"GHSA-x25m-ph3m-3r9q","kind":"vulnerability","aliases":["GHSA-x25m-ph3m-3r9q"],"related":[],"title":"CVE-2026-85788 - Issue with awslabs mysql-mcp-server","description":"CVE-2026-85788 - Issue with awslabs mysql-mcp-server\n\n### CVE-2026-85788 - Issue with awslabs mysql-mcp-server\n\nBulletin ID: 2026-103-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 09:15 PM PDT\n\nDescription:\n\nWe identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain conditions the read-only enforcement could be circumvented via SQL inline comments, allowing a statement to run that the read-only check was expected to block. The read-only mode provided by the server is a best-effort safeguard and is not a substitute for correctly scoped database permissions; the effective boundary is the permissions of the configured MySQL user.\n\nThis issue does not affect the confidentiality or integrity of any AWS service. awslabs.mysql-mcp-server is a client-side, self-managed package; customers control installation and the privileges of the database credentials they configure.\n\nAffected versions: awslabs.mysql-mcp-server ≤ 1.0.21\n\nResolution:\n\nThe issue is addressed in awslabs.mysql-mcp-server 1.0.23. We recommend customers upgrade to 1.0.23 or later:\n\n pip install --upgrade awslabs.mysql-mcp-server\n\nAs defense in depth, ensure the database user configured for the MCP server is granted only the minimum privileges required, and does not hold the FILE privilege unless explicitly needed.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-85788\n- GHSA-x25m-ph3m-3r9q\n\nAcknowledgement:\n\nWe would like to thank Jaeyoung Yun for reporting this issue and working with us as part of our coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The awslabs mysql-mcp-server, a Model Context Protocol server for MySQL, could be tricked by SQL inline comments into running a statement its read-only check was meant to block. An attacker who can send queries through the server can write or change data the read-only mode was supposed to protect.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","lab-disclosure","mcp","mysql","python","self-hosted"],"not_affected_if":["not-using-mysql-mcp-server","version-1.0.23-or-later"],"how_to_check":"- Check the installed version with `pip show awslabs.mysql-mcp-server`; versions `1.0.21` and earlier are affected.\n- Check whether the MySQL user configured for the server holds write or FILE privileges, for example with `SHOW GRANTS FOR 'mcp_user'@'%';`.","fix":"- Upgrade to `awslabs.mysql-mcp-server` `1.0.23` or later with `pip install --upgrade awslabs.mysql-mcp-server`.\n- Grant the MCP database user only the minimum privileges needed and do not give it the FILE privilege unless required.","status":"open","published_at":"2026-09-09T00:00:00+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:30:37+00:00","updated_at":"2026-10-25T05:30:37+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T05:30:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `awslabs.mysql-mcp-server` `1.0.23` or later with `pip install --upgrade awslabs.mysql-mcp-server`.\n- Grant the MCP database user only the minimum privileges needed and do not give it the FILE privilege unless required.","reach":"unknown","title":"AWS MySQL MCP server: inline SQL comments bypass read-only mode","impact":"medium","summary":"The awslabs mysql-mcp-server, a Model Context Protocol server for MySQL, could be tricked by SQL inline comments into running a statement its read-only check was meant to block. An attacker who can send queries through the server can write or change data the read-only mode was supposed to protect.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","mysql","python","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Unauthorized SQL statements run against the MySQL database through the MCP server","analyst_note":"","how_to_check":"- Check the installed version with `pip show awslabs.mysql-mcp-server`; versions `1.0.21` and earlier are affected.\n- Check whether the MySQL user configured for the server holds write or FILE privileges, for example with `SHOW GRANTS FOR 'mcp_user'@'%';`.","needs_analyst":false,"not_affected_if":["version-1.0.23-or-later","not-using-mysql-mcp-server"],"who_is_affected":"Teams that self-host awslabs.mysql-mcp-server at version 1.0.21 or earlier and connect it to a MySQL database. The read-only mode is a best-effort safeguard, so the real boundary is the privileges of the configured database user. Teams not running this package, or running it at 1.0.23 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":3927,"output_tokens":657,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103':113C '-2026':2A,91C,101C,331C '-85788':3A,92C,102C,332C '/awslabs/mcp':154C '09':125C '09/09/2026':124C '1.0.21':270C '1.0.23':281C,287C '15':126C '2026':112C '3r9q':15A,20A,337C 'acknowledg':338C 'address':275C 'affect':158C,230C,264C 'ai':22B 'ai-tool':21B 'allow':175C 'attack':68B 'attent':121C 'aw':24B,114C,116C,237C 'aws-security@amazon.com':363C 'awslab':6A,35B,95C,105C 'awslabs.mysql':135C,239C,266C,277C,293C 'best':202C 'best-effort':201C 'block':66B,189C 'boundari':217C 'bulletin':110C 'certain':161C 'chang':79B 'check':62B,185C 'circumv':170C 'client':246C 'client-sid':245C 'comment':53B,174C 'concern':369C 'condit':162C 'confidenti':232C 'configur':223C,263C,305C 'content':117C 'context':42B,147C 'control':253C 'coordin':358C 'correct':211C 'could':47B,168C 'credenti':261C 'custom':252C,284C 'cve':1A,90C,100C,330C 'data':80B 'databas':213C,260C,303C 'date':123C 'defens':298C 'depth':300C 'descript':129C 'disclosur':27B,359C 'distribut':150C 'effect':216C 'effort':203C 'email':362C 'enforc':167C 'ensur':301C 'expect':187C 'explicit':325C 'file':322C 'ghsa':12A,17A,334C 'ghsa-x25m-ph3m-3r9q':11A,16A,333C 'github.com':153C 'github.com/awslabs/mcp':152C 'grant':311C 'hold':320C 'host':33B,145C 'id':111C 'identifi':131C 'import':119C 'inlin':52B,173C 'instal':254C,291C 'integr':234C 'issu':4A,93C,103C,133C,227C,273C,349C 'jaeyoung':344C 'lab':26B 'lab-disclosur':25B 'later':289C 'like':341C 'manag':250C 'mcp':9A,28B,38B,98C,108C,137C,241C,268C,279C,295C,308C 'mcp-server':136C,240C,267C,278C,294C 'meant':64B 'minimum':314C 'mode':85B,194C 'model':41B,146C 'mysql':8A,29B,37B,46B,97C,107C,224C 'mysql-mcp-serv':7A,36B,96C,106C 'need':326C 'none':328C 'open':141C 'open-sourc':140C 'packag':251C 'part':355C 'pdt':128C 'permiss':214C,220C 'ph3m':14A,19A,336C 'pip':290C 'pleas':361C 'pm':127C 'privileg':257C,315C,323C 'process':360C 'protect':89B 'protocol':43B,148C 'provid':195C 'public':122C 'pypi':156C 'python':30B 'queri':72B 'question':367C 'read':60B,83B,165C,183C,192C 'read-on':59B,82B,164C,182C,191C 'recommend':283C 'refer':329C 'report':347C 'requir':120C,316C 'resolut':271C 'run':55B,179C 'safeguard':204C 'scope':115C,212C 'secur':366C 'self':32B,144C,249C 'self-host':31B,143C 'self-manag':248C 'send':71B 'server':10A,39B,44B,75B,99C,109C,138C,149C,198C,242C,269C,280C,296C,309C 'servic':238C 'side':247C 'sourc':142C 'sql':51B,172C 'statement':57B,177C 'substitut':209C 'suppos':87B 'thank':343C 'tool':23B 'trick':49B 'type':118C 'unless':324C 'upgrad':285C,292C 'us':353C 'user':225C,304C 'version':159C,265C 'via':151C,171C 'work':351C 'workaround':327C 'would':340C 'write':77B 'x25m':13A,18A,335C 'yun':345C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host awslabs.mysql-mcp-server at version 1.0.21 or earlier and connect it to a MySQL database. The read-only mode is a best-effort safeguard, so the real boundary is the privileges of the configured database user. Teams not running this package, or running it at 1.0.23 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/#GHSA-x25m-ph3m-3r9q","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/","severity":null,"published_at":"2026-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"AWS: CVE-2026-85788 - Issue with awslabs mysql-mcp-server"}],"documents":[{"id":2885,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/","title":"AWS: CVE-2026-85788 - Issue with awslabs mysql-mcp-server","kind":"advisory","source":"lab","text":"CVE-2026-85788 - Issue with awslabs mysql-mcp-server\n\n### CVE-2026-85788 - Issue with awslabs mysql-mcp-server\n\nBulletin ID: 2026-103-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/09/2026 09:15 PM PDT\n\nDescription:\n\nWe identified an issue in awslabs.mysql-mcp-server (an open-source, self-hosted Model Context Protocol server distributed via github.com/awslabs/mcp and PyPI). In affected versions, under certain conditions the read-only enforcement could be circumvented via SQL inline comments, allowing a statement to run that the read-only check was expected to block. The read-only mode provided by the server is a best-effort safeguard and is not a substitute for correctly scoped database permissions; the effective boundary is the permissions of the configured MySQL user.\n\nThis issue does not affect the confidentiality or integrity of any AWS service. awslabs.mysql-mcp-server is a client-side, self-managed package; customers control installation and the privileges of the database credentials they configure.\n\nAffected versions: awslabs.mysql-mcp-server ≤ 1.0.21\n\nResolution:\n\nThe issue is addressed in awslabs.mysql-mcp-server 1.0.23. We recommend customers upgrade to 1.0.23 or later:\n\n pip install --upgrade awslabs.mysql-mcp-server\n\nAs defense in depth, ensure the database user configured for the MCP server is granted only the minimum privileges required, and does not hold the FILE privilege unless explicitly needed.\n\nWorkarounds:\n\nNone.\n\nReferences:\n\n- CVE-2026-85788\n- GHSA-x25m-ph3m-3r9q\n\nAcknowledgement:\n\nWe would like to thank Jaeyoung Yun for reporting this issue and working with us as part of our coordinated disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":"2026-09-09T00:00:00+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}