CVE-2026-61788: Bytebase DBHub read-only mode bypass via function calls

CVE-2026-61788 · Severity: high · CVSS 7.4 · Published 2026-09-24

Bytebase DBHub is a code library for executing SQL queries against databases. When the read-only mode is enabled on the execute_sql tool to prevent data modification, it can be bypassed using database functions like lo_export, pg_read_file, and dblink that perform writes or execute commands despite appearing as SELECT statements. Attackers can modify data, write files to the database server, read sensitive host files, or execute arbitrary code—especially dangerous when DBHub is configured with privileged database credentials or exposed via the unauthenticated HTTP interface.

Technologies: Bytebase DBHub, @bytebase/dbhub (npm). Vendors: Bytebase, npm.

Quick answers

Is CVE-2026-61788 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61788 being exploited in the wild.
How severe is CVE-2026-61788?
High severity, with a CVSS score of 7.4, published 24 September 2026.
Which products and versions are affected?
Bytebase DBHub up to and including 0.22.2; @bytebase/dbhub (npm) < 0.22.6, SEMVER:introduced=0,fixed=0.22.6.
Is there a fix for CVE-2026-61788?
Yes. @bytebase/dbhub (npm): upgrade to 0.22.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61788 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61788?
Check whether you run Bytebase DBHub or @bytebase/dbhub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @bytebase/dbhub (npm): upgrade to 0.22.6 or later
    npm install @bytebase/dbhub@0.22.6

Technical details

The vulnerability stems from two root causes: (1) a configuration pathway that never activates connection-level read-only enforcement in PostgreSQL (default_transaction_read_only), SQLite (readOnly mode), or MySQL/MariaDB (START TRANSACTION READ ONLY), leaving only a keyword-based classifier as protection; and (2) the classifier checks only the first SQL keyword, allowing any SELECT statement to pass even when it calls side-effecting functions. Functions like setval() (sequence modification), lo_export() (arbitrary file write), pg_read_file() (arbitrary file read), and dblink_exec() with COPY TO PROGRAM (remote code execution) all bypass the read-only check. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default, making this remotely exploitable via /mcp endpoint or through MCP clients. The issue affects all versions up to 0.22.2 on PostgreSQL, SQLite, and MySQL/MariaDB.

Affected products

  • Bytebase DBHub up to and including 0.22.2

Identifiers

  • CVE-2026-61788
  • GHSA-mwwr-p57h-56pf

Timeline

  • 2026-09-24: disclosed
  • 2026-09-24: patched: Fix available in PR#342 adds engine-level read-only enforcement and classifier hardening

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.