MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

🗓️ 01 Oct 2026 16:38:30Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

Unauthenticated arbitrary SQL execution in MySQL MCP Server via SSE transport.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-59971	11 Sep 202622:20	–	circl
CVE	CVE-2026-59971	15 Sep 202614:10	–	cve
Cvelist	CVE-2026-59971 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)	15 Sep 202614:10	–	cvelist
EUVD	EUVD-2026-78580	15 Sep 202614:10	–	euvd
Github Security Blog	MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)	11 Sep 202620:35	–	github
NVD	CVE-2026-59971	15 Sep 202615:17	–	nvd
OSV	GHSA-RQFV-2MW9-78G2 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)	11 Sep 202620:35	–	osv
OSV	PYSEC-2026-4109 MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-90533	11 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-59971: Missing Authentication for Critical Function	15 Sep 202600:00	–	rapid7

Vulners

Node

Source	Link
github	www.github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2
github	www.github.com/designcomputer/mysql_mcp_server/issues/92
github	www.github.com/designcomputer/mysql_mcp_server
github	www.github.com/designcomputer/mysql_mcp_server/releases/tag/v0.4.2
pypi	www.pypi.org/project/mysql-mcp-server
github	www.github.com/advisories/GHSA-rqfv-2mw9-78g2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-59971

01 Oct 2026 17:10Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.110

EPSS0.00418

SSVC