Executive brief
MySQL MCP Server is a tool that allows AI systems to safely interact with MySQL databases. When deployed in SSE/HTTP transport mode (rather than the default stdio mode), the service listens on all network interfaces by default with no authentication and no protection against DNS rebinding attacks. An attacker on the network can execute arbitrary SQL queries remotely, leading to complete database compromise, data theft, modification, and potential remote code execution if the database user has file privileges.
Technical details
The vulnerability is a missing authentication and origin validation issue in MySQL MCP Server's SSE/HTTP transport layer. When MCP_TRANSPORT=sse is configured, the SseServerTransport is instantiated without passing security_settings, causing the MCP Python SDK to default enable_dns_rebinding_protection to False. Additionally, the Starlette web application lacks CORS and TrustedHost middleware, and all routes (/, /sse, /messages/) are completely unauthenticated. The service binds to 0.0.0.0 by default, making it reachable from any network. Attackers can invoke the execute_sql endpoint with fully controlled SQL queries, bypassing all authentication. The vulnerability enables two attack scenarios: (1) direct network exposure where any attacker executes SQL remotely, or (2) DNS rebinding where an attacker lures a victim's browser to a malicious site, rebinds their domain to 127.0.0.1, and uses the browser as a proxy. The sink is cursor.execute(query) with attacker-controlled input. If the MySQL account holds FILE privileges, attackers can read/write arbitrary files and potentially achieve RCE via webshell deployment. The fix was released in v0.4.2 by enabling DNS-rebinding protection and documenting 127.0.0.1 as the recommended bind address.
Affected products
- designcomputer mysql-mcp-server < 0.4.2
Timeline
- 2026-09-11: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-09-11: patched: Fix released in v0.4.2 with DNS-rebinding protection enabled and 127.0.0.1 recommended as bind address
References
- https://api.github.com/users/designcomputer
- https://github.com/designcomputer
- https://api.github.com/users/designcomputer/gists%7B/gist_id%7D
- https://api.github.com/users/designcomputer/repos
- https://avatars.githubusercontent.com/u/25017723?v=4
- https://api.github.com/users/designcomputer/events%7B/privacy%7D