Executive brief
AWS Labs mysql-mcp-server is an open-source tool that allows applications to interact with MySQL databases through the Model Context Protocol. The tool includes a read-only enforcement feature designed to prevent unauthorized write operations. This vulnerability allows an attacker to bypass the read-only safeguard using SQL inline comments, potentially executing write or dangerous operations that should have been blocked.
Technical details
The vulnerability exists in the read-only enforcement logic of AWS Labs mysql-mcp-server, where SQL inline comments can be used to bypass validation checks intended to prevent write operations in read-only mode. The root cause is insufficient parsing and normalization of SQL statements before the read-only check is applied. The attack vector is network-based, requiring network access to the MCP server; no authentication bypass is required if the attacker already has access to invoke the server. An attacker can craft malicious SQL statements with inline comments (e.g., /* ... */) to trigger execution of forbidden operations such as INSERT, UPDATE, DELETE, or DROP. AWS emphasizes that this is a best-effort safeguard; proper mitigation requires correctly scoped database user permissions. A patch is available in versions after 1.0.21.
Affected products
- AWS Labs mysql-mcp-server <=1.0.21
Timeline
- 2026-09-09: disclosed