CVE-2026-59971 is a critical vulnerability in the mysql-mcp-server project that enables unauthenticated SQL execution via DNS rebinding or direct exposure, allowing an attacker to run arbitrary SQL without credentials and potentially leading to full data dump, file read/write, and remote code execution. The flaw arises from the construction of SseServerTransport without passing security settings, disabling origin/host validation, CORS, and TrustedHost middleware, and binding to 0.0.0.0 by default with no authentication on any route. This allows an attacker to invoke execute_sql as same-origin via DNS rebinding or directly expose the service for unauthenticated SQL execution. The vulnerability affects versions prior to 0.4.2, posing a significant threat to data integrity and confidentiality, with internet-wide scanning identifying publicly reachable SSE instances of this project. The CVSS v3 score is 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating a critical severity level.
We recommend you to update mysql-mcp-server to version 0.4.2.[/subscribe_to_unlock_form]
CVE-2026-59971 is a critical vulnerability in the mysql-mcp-server project that enables unauthenticated SQL execution via DNS rebinding or direct exposure, allowing an attacker to run arbitrary SQL without credentials and potentially leading to full data dump, file read/write, and remote code execution. The flaw arises from the construction of SseServerTransport without passing security settings, disabling origin/host validation, CORS, and TrustedHost middleware, and binding to 0.0.0.0 by default with no authentication on any route. This allows an attacker to invoke execute_sql as same-origin via DNS rebinding or directly expose the service for unauthenticated SQL execution. The vulnerability affects versions prior to 0.4.2, posing a significant threat to data integrity and confidentiality, with internet-wide scanning identifying publicly reachable SSE instances of this project. The CVSS v3 score is 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating a critical severity level.
We recommend you to update mysql-mcp-server to version 0.4.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]