GHSA-J656-3HF2-FVJC DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

CVE-2026-61789 DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and...

CVE-2026-61789 DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and...

CVE-2026-61789

DBHub, a database MCP server, contains a vulnerability in its MySQL and MariaDB connectors prior to version 0.22.6 . The root cause is an interpretation conflict in src/utils/sql-parser.ts, where scanSingleLineComment incorrectly treats every double dash (--) as a comment start, unlike the actual...