CVE-2026-61789

DBHub MySQL read-only guard can permit destructive SQL

Bytebase · DBHub MCP database server

First documented disclosure · Review checkpoint

Summary

A SQL parsing mismatch can bypass the read-only guard on MySQL and MariaDB.

Severity and exploitation evidence

Medium · 6.1/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

DBHub treated any double dash as a comment, whereas these databases require following whitespace or a control/end character. Validation checked split statements, but connectors executed the original string with multiple statements enabled.

Conditions required

An attacker can influence SQL submitted through the tool, including through prompt injection, and the configured database account has privileges to perform the requested write.

Potential impact

Unauthorized writes and destructive DDL within the database account permissions; PostgreSQL is not affected by this particular parser path.

Affected versions and configurations

DBHub before 0.22.6; affected MySQL/MariaDB read-only tool paths.

Fix and mitigation status

0.22.6 fixes this issue; later findings still require current supported releases.

Practical next steps

Upgrade and use database-enforced least privilege. Do not grant write or DDL permissions to an assistant intended only to read. The patch combines dialect-aware scanning with engine-level controls.

Operating lesson

A read-only label must be enforced by the database account as well as the tool parser.

Evidence and limits

Public advisory and fix PR are June 24; the 0.22.6 release is July 10 and CVE publication October 30. The CNA assigns Medium 6.1 CVSS 4.0, while the maintainer advisory labels the issue High. MySQL implicit-commit DDL still requires the parser fix; a read-only transaction alone is not sufficient.

Sources