# CVE-2026-61789: DBHub read-only mode bypass in MySQL and MariaDB

Source: https://junglewise.ai/threats/cve-2026-61789-dbhub-is-a-database-mcp-server-for-postgres-mysql-sql-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-61789 · Severity: medium · CVSS 4 · Published 2026-10-30

DBHub is a database management interface that allows controlled access to multiple database engines including MySQL, MariaDB, PostgreSQL, and others. Prior to version 0.22.6, an attacker could bypass read-only mode protections on MySQL and MariaDB databases by using SQL comments with specific syntax, allowing unauthorized modification or deletion of database contents. This could be exploited through prompt injection or by influencing SQL queries passed to the tool.

Technologies: [Bytebase DBHub](https://junglewise.ai/threats/technologies/dbhub), [@bytebase/dbhub (npm)](https://junglewise.ai/threats/technologies/bytebase-dbhub). Vendors: [Bytebase](https://junglewise.ai/threats/vendors/bytebase), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-61789 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61789 being exploited in the wild.

**How severe is CVE-2026-61789?** Medium severity, with a CVSS score of 4, published 30 October 2026.

**Which products and versions are affected?** Bytebase DBHub before 0.22.6; @bytebase/dbhub (npm) SEMVER:introduced=0,fixed=0.22.6.

**Is there a fix for CVE-2026-61789?** Yes. @bytebase/dbhub (npm): upgrade to 0.22.6 or later. Until then: Restrict the ability to influence SQL queries passed to DBHub, including sanitizing or restricting content that the assistant reads and processes. Consider disabling read-only mode enforcement until upgrading, or restrict database account privileges to limit damage from potential bypass exploitation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61789 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61789?** Check whether you run Bytebase DBHub or @bytebase/dbhub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @bytebase/dbhub (npm): upgrade to 0.22.6 or later

  ```sh
  npm install @bytebase/dbhub@0.22.6
  ```


Restrict the ability to influence SQL queries passed to DBHub, including sanitizing or restricting content that the assistant reads and processes. Consider disabling read-only mode enforcement until upgrading, or restrict database account privileges to limit damage from potential bypass exploitation.

## Technical details

The vulnerability stems from incorrect parsing of SQL double-dash (--) comments in the read-only validator. The validator in `src/utils/sql-parser.ts` treats every `--` as a comment start, but MySQL and MariaDB require following whitespace, control characters, or end-of-line. This mismatch allows a double dash followed by non-whitespace (e.g., `SELECT 1--1;DROP TABLE t`) to pass validation as read-only, while the database interprets the dashes as minus operators and executes both statements. The vulnerability affects MySQL and MariaDB connectors which execute original statements with `multipleStatements` enabled; PostgreSQL is unaffected because its parser aligns with the validator. Fixed in version 0.22.6.

## Affected products

- Bytebase DBHub before 0.22.6

## Identifiers

- CVE-2026-61789
- GHSA-j656-3hf2-fvjc

## Timeline

- 2026-10-30: disclosed
- 2026-06-24: patched

## References

- [https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08](https://github.com/bytebase/dbhub/commit/872bb338f7d31f6afe517a076ac3e3edafaaaf08)
- [https://github.com/bytebase/dbhub/pull/342](https://github.com/bytebase/dbhub/pull/342)

## Related threats

- [ByteBase DBHub read-only mode bypass via SQL comment in MySQL](https://junglewise.ai/threats/cve-2026-79536-bytebase-dbhub-v1-2-0-was-discovered-to-contain-a-sql-injection)
- [Bytebase DBHub read-only mode bypass via function calls](https://junglewise.ai/threats/cve-2026-61788-bytebase-dbhub-read-only-mode-bypass-via-function-calls)
- [DBHub HTTP transport DNS rebinding allows unauthenticated SQL execution](https://junglewise.ai/threats/cve-2026-61742-dbhub-http-transport-dns-rebinding-allows-unauthenticated-sql)