CVE-2026-59971
CriticalCVSS 10.0Summary
MySQL MCP Server prior to 0.4.2, when MCP_TRANSPORT=sse is set, constructs SseServerTransport without security settings or DNS rebinding protection, while the /, /sse, and /messages/ routes have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql or use DNS rebinding to gain unauthorized access to the database. The issue is fixed in 0.4.2.
Risk Assessment
Unauthenticated disclosure and modification of the configured MySQL database is possible, and with FILE privileges the same access can read or write server files and may enable code execution. The default stdio transport is not affected.
Recommendation
Upgrade MySQL MCP Server to version 0.4.2 or later. Where possible, use the default stdio transport and avoid exposing the service on 0.0.0.0.
Other vulnerabilities in MySQL MCP Server
See all- CVE-2026-85788Medium
Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace. To remediate this issue, users should upgrade to version 1.0.23.
- CVE-2026-11529Medium
A SQL injection vulnerability was detected in designcomputer mysql-mcp-server up to version 0.2.2 in the read_resource function of src/mysql_mcp_server/server.py in the mysql URI Handler component via manipulation of the uri_str argument. The attack can be carried out remotely, and the exploit has been publicly disclosed. The issue is fixed in version 0.3.0.
Original NVD description (English source)
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.