# CVE-2026-79536: ByteBase DBHub read-only mode bypass via SQL comment in MySQL

Source: https://junglewise.ai/threats/cve-2026-79536-bytebase-dbhub-v1-2-0-was-discovered-to-contain-a-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-79536 · Severity: info · Published 2026-09-29

ByteBase DBHub is a database management tool that allows operators to safely expose databases to AI agents and clients in read-only mode. An attacker can bypass this read-only protection on MySQL and MariaDB backends by injecting hidden SQL statements using comment syntax, allowing them to write data, modify rows, or drop tables despite the read-only guarantee. No authentication is required for this exploit in the default configuration.

Technologies: [Bytebase DBHub](https://junglewise.ai/threats/technologies/dbhub). Vendors: [Bytebase](https://junglewise.ai/threats/vendors/bytebase).

## Quick answers

**Is CVE-2026-79536 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79536 being exploited in the wild.

**How severe is CVE-2026-79536?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Bytebase DBHub v1.2.0 and earlier.

**Is there a fix for CVE-2026-79536?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79536 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79536?** Check whether you run Bytebase DBHub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) and SQL injection (CWE-89) in the SQL classifier (src/utils/sql-parser.ts, function scanTokenMySQL) that fails to recognize # as a single-line comment in MySQL/MariaDB. An attacker can prefix a write or DDL statement with # to hide it from the classifier; the parser treats # as a string literal rather than a comment separator, so it sees only the leading harmless read statement and permits the request. When the unmodified SQL reaches MySQL/MariaDB with multipleStatements enabled, both statements execute, allowing writes or destructive DDL despite read-only mode. Network access to DBHub's HTTP endpoint is required, but no authentication is needed by default.

## Affected products

- ByteBase DBHub v1.2.0 and earlier

## Timeline

- 2026-07-14: disclosed: Vulnerability reported to maintainer by Traceforce
- 2026-08-21: advisory: Reported via MITRE
- 2026-09-10: other: CVE ID CVE-2026-79536 assigned by MITRE
- 2026-09-22: disclosed: Security advisory published by Traceforce

## References

- [https://www.traceforce.ai/security-advisories/cve-2026-79536](https://www.traceforce.ai/security-advisories/cve-2026-79536)

## Related threats

- [DBHub read-only mode bypass in MySQL and MariaDB](https://junglewise.ai/threats/cve-2026-61789-dbhub-is-a-database-mcp-server-for-postgres-mysql-sql-server)
- [Bytebase DBHub read-only mode bypass via function calls](https://junglewise.ai/threats/cve-2026-61788-bytebase-dbhub-read-only-mode-bypass-via-function-calls)
- [DBHub HTTP transport DNS rebinding allows unauthenticated SQL execution](https://junglewise.ai/threats/cve-2026-61742-dbhub-http-transport-dns-rebinding-allows-unauthenticated-sql)