Executive brief
ProxySQL is a high-performance database proxy used to manage traffic between applications and database servers like MySQL and PostgreSQL. A security flaw in its GenAI/MCP component allows users to bypass "read-only" restrictions and execute unauthorized commands that can modify or delete database tables. This could lead to unauthorized data modification, administrative disruption, or loss of data integrity if the MCP feature is enabled and exposed.
Technical details
A vulnerability exists in the ProxySQL GenAI/MCP `run_sql_readonly` tool due to improper input validation and insecure database connection settings. The tool uses a simple keyword allowlist (e.g., checking if a query starts with 'SELECT') and a substring blacklist, but fails to account for multi-statement queries when the backend connection is initialized with the `CLIENT_MULTI_STATEMENTS` flag. An attacker can submit a legitimate read-only statement followed by a malicious side-effecting statement (e.g., `SELECT 1; RENAME TABLE...`). Because the validator only inspects the start of the string and misses several dangerous keywords like `RENAME`, `SET`, and `KILL`, the entire payload is executed. This allows unauthenticated or unauthorized users (depending on `mcp-query_endpoint_auth` settings) to perform writes or administrative actions on the backend database. The issue is fixed in versions 3.0.9 and 4.0.9.
Affected products
- sysown ProxySQL 3.0.0 - 3.0.8, 4.0.6 - 4.0.8
Timeline
- 2026-05-26: disclosed: Initial advisory publication by maintainer
- 2026-06-19: advisory: NVD publication date
- 2026-06-19: patched: Fixes available in versions 3.0.9 and 4.0.9