CVE-2026-79536
UnknownSummary
SQL injection vulnerability in dbhub v1.2.0 in the /utils/sql-parser.ts component. Attackers can access sensitive database information via crafted SQL statements.
Risk Assessment
An attacker can read, modify, or delete database data, leading to confidentiality and integrity breaches.
Recommendation
Update dbhub to the latest version and use parameterized SQL queries.
Other vulnerabilities in dbhub
See all- CVE-2026-61742Critical
DBHub, a database MCP server, in versions prior to 0.22.5 exposes an unauthenticated HTTP MCP endpoint when started in HTTP transport mode. Its protection based on comparing Origin and Host headers does not prevent DNS rebinding, allowing a malicious website to invoke MCP tools from the victim's browser. Depending on configuration, this can lead to reading, enumerating, and potentially writing database contents.
- CVE-2026-61788High
DBHub prior to version 0.22.6 does not enforce read-only mode for the execute_sql tool even when readonly = true is set. The code that would enforce read-only is never executed, leaving only a simple classifier that checks the first keyword of each statement. This allows sequence tampering, arbitrary file writes, host file reads, and remote code execution. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default.
Original NVD description (English source)
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS