Is CVE-2026-48774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48774 being exploited in the wild.

How severe is CVE-2026-48774?

High severity, with a CVSS score of 7.5, published 19 June 2026.

Which products and versions are affected?

sysown ProxySQL 3.0.0 - 3.0.8, 4.0.6 - 4.0.8.

Is there a fix for CVE-2026-48774?

A patch was published on 2026-06-19: Fixes available in versions 3.0.9 and 4.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48774 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-48774?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48774: ProxySQL bypass of read-only contract in GenAI MCP tool

CVE-2026-48774 · Severity: high · CVSS 7.5 · Published 2026-06-19

ProxySQL is a high-performance database proxy used to manage traffic between applications and database servers like MySQL and PostgreSQL. A security flaw in its GenAI/MCP component allows users to bypass "read-only" restrictions and execute unauthorized commands that can modify or delete database tables. This could lead to unauthorized data modification, administrative disruption, or loss of data integrity if the MCP feature is enabled and exposed.

Quick answers

Is CVE-2026-48774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48774 being exploited in the wild.
How severe is CVE-2026-48774?: High severity, with a CVSS score of 7.5, published 19 June 2026.
Which products and versions are affected?: sysown ProxySQL 3.0.0 - 3.0.8, 4.0.6 - 4.0.8.
Is there a fix for CVE-2026-48774?: A patch was published on 2026-06-19: Fixes available in versions 3.0.9 and 4.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48774 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-48774?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the ProxySQL GenAI/MCP `run_sql_readonly` tool due to improper input validation and insecure database connection settings. The tool uses a simple keyword allowlist (e.g., checking if a query starts with 'SELECT') and a substring blacklist, but fails to account for multi-statement queries when the backend connection is initialized with the `CLIENT_MULTI_STATEMENTS` flag. An attacker can submit a legitimate read-only statement followed by a malicious side-effecting statement (e.g., `SELECT 1; RENAME TABLE...`). Because the validator only inspects the start of the string and misses several dangerous keywords like `RENAME`, `SET`, and `KILL`, the entire payload is executed. This allows unauthenticated or unauthorized users (depending on `mcp-query_endpoint_auth` settings) to perform writes or administrative actions on the backend database. The issue is fixed in versions 3.0.9 and 4.0.9.

Affected products

sysown ProxySQL 3.0.0 - 3.0.8, 4.0.6 - 4.0.8

Timeline

2026-05-26: disclosed: Initial advisory publication by maintainer
2026-06-19: advisory: NVD publication date
2026-06-19: patched: Fixes available in versions 3.0.9 and 4.0.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.