# CVE-2026-61742: DBHub HTTP transport DNS rebinding allows unauthenticated SQL execution

Source: https://junglewise.ai/threats/cve-2026-61742-dbhub-http-transport-dns-rebinding-allows-unauthenticated-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61742 · Severity: critical · CVSS 4 · Published 2026-09-24

DBHub is a database client tool that can be run in HTTP server mode for remote access and web-based clients. When started with HTTP transport, it exposes an unauthenticated endpoint vulnerable to DNS rebinding attacks. An attacker can trick a victim's browser into executing arbitrary SQL queries against the victim's database, allowing unauthorized data exfiltration or modification without authentication.

Technologies: [Bytebase DBHub](https://junglewise.ai/threats/technologies/dbhub), [@bytebase/dbhub (npm)](https://junglewise.ai/threats/technologies/bytebase-dbhub). Vendors: [Bytebase](https://junglewise.ai/threats/vendors/bytebase), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-61742 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61742 being exploited in the wild.

**How severe is CVE-2026-61742?** Critical severity, with a CVSS score of 4, published 24 September 2026.

**Which products and versions are affected?** Bytebase DBHub 0.21.2; @bytebase/dbhub (npm) <= 0.22.4, SEMVER:introduced=0,fixed=0.22.5.

**Is there a fix for CVE-2026-61742?** Yes. @bytebase/dbhub (npm): upgrade to 0.22.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61742 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61742?** Check whether you run Bytebase DBHub or @bytebase/dbhub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @bytebase/dbhub (npm): upgrade to 0.22.5 or later

  ```sh
  npm install @bytebase/dbhub@0.22.5
  ```


## Technical details

DBHub's HTTP server attempts to prevent cross-origin browser attacks by comparing the `Origin` and `Host` header hostnames, then reflecting the validated origin into `Access-Control-Allow-Origin`. However, this check is insufficient against DNS rebinding: after an attacker-controlled hostname rebinds to the victim's DBHub server IP address, both headers contain the attacker's hostname, so the equality check passes. The vulnerability is in `/src/server.ts` middleware that does not enforce an explicit allowed-hosts policy. The HTTP `/mcp` endpoint accepts unauthenticated JSON-RPC method calls with no CSRF protection. Attack vector is network and requires victim browser interaction (visiting attacker-controlled website), but no authentication credentials. A successful exploit grants access to all MCP tools (e.g., `execute_sql`) with permissions inherited from the DBHub server process, enabling SQL injection, data exfiltration, and potentially data modification depending on configured permissions.

## Affected products

- Bytebase DBHub 0.21.2

## Identifiers

- CVE-2026-61742
- GHSA-fm8p-53ww-hf6w

## Timeline

- 2026-09-24: disclosed: Advisory published; PoC provided
- 2026-01-01: other: CVE-2026-61742 assigned

## Related threats

- [DBHub read-only mode bypass in MySQL and MariaDB](https://junglewise.ai/threats/cve-2026-61789-dbhub-is-a-database-mcp-server-for-postgres-mysql-sql-server)
- [ByteBase DBHub read-only mode bypass via SQL comment in MySQL](https://junglewise.ai/threats/cve-2026-79536-bytebase-dbhub-v1-2-0-was-discovered-to-contain-a-sql-injection)
- [Bytebase DBHub read-only mode bypass via function calls](https://junglewise.ai/threats/cve-2026-61788-bytebase-dbhub-read-only-mode-bypass-via-function-calls)