CVE-2026-59971: MySQL MCP Server missing authentication and DNS rebinding protection in SSE transport

CVE-2026-59971 · Severity: critical · CVSS 10 · Published 2026-09-15

MySQL MCP Server is a tool that allows AI systems to safely interact with MySQL databases. When deployed in SSE/HTTP transport mode (rather than the default stdio mode), the service listens on all network interfaces by default with no authentication and no protection against DNS rebinding attacks. An attacker on the network can execute arbitrary SQL queries remotely, leading to complete database compromise, data theft, modification, and potential remote code execution if the database user has file privileges.

Vendors: PyPI.

Quick answers

Is CVE-2026-59971 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59971 being exploited in the wild.
How severe is CVE-2026-59971?
Critical severity, with a CVSS score of 10, published 15 September 2026.
Which products and versions are affected?
mysql-mcp-server (PyPI) ECOSYSTEM:introduced=0,fixed=0.4.2.
Is there a fix for CVE-2026-59971?
Yes. mysql-mcp-server (PyPI): upgrade to 0.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59971 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59971?
Check whether you run mysql-mcp-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mysql-mcp-server (PyPI): upgrade to 0.4.2 or later
    pip install "mysql-mcp-server>=0.4.2"

Technical details

The vulnerability is a missing authentication and origin validation issue in MySQL MCP Server's SSE/HTTP transport layer. When MCP_TRANSPORT=sse is configured, the SseServerTransport is instantiated without passing security_settings, causing the MCP Python SDK to default enable_dns_rebinding_protection to False. Additionally, the Starlette web application lacks CORS and TrustedHost middleware, and all routes (/, /sse, /messages/) are completely unauthenticated. The service binds to 0.0.0.0 by default, making it reachable from any network. Attackers can invoke the execute_sql endpoint with fully controlled SQL queries, bypassing all authentication. The vulnerability enables two attack scenarios: (1) direct network exposure where any attacker executes SQL remotely, or (2) DNS rebinding where an attacker lures a victim's browser to a malicious site, rebinds their domain to 127.0.0.1, and uses the browser as a proxy. The sink is cursor.execute(query) with attacker-controlled input. If the MySQL account holds FILE privileges, attackers can read/write arbitrary files and potentially achieve RCE via webshell deployment. The fix was released in v0.4.2 by enabling DNS-rebinding protection and documenting 127.0.0.1 as the recommended bind address.

Affected products

  • designcomputer mysql-mcp-server < 0.4.2

Identifiers

  • CVE-2026-59971
  • GHSA-rqfv-2mw9-78g2
  • PYSEC-2026-4109

Timeline

  • 2026-09-11: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-09-11: patched: Fix released in v0.4.2 with DNS-rebinding protection enabled and 127.0.0.1 recommended as bind address

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.