EUVD-2026-86326

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...

CVE-2026-61788

The @bytebase/dbhub database MCP server (prior to version 0.22.6 ) contains a vulnerability where setting readonly = true on the execute_sql tool fails to enforce a read-only connection. The root cause is that the configuration value required to trigger the actual database read-only mode is never...

EUVD-2026-86320

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect...

CVE-2026-61742

The DBHub database MCP server (versions prior to 0.22.5 ) is vulnerable to a DNS rebinding attack when using the HTTP transport mode (e.g., --transport http --port 8080). The server fails to properly validate browser-origin access because it reflects the Origin hostname into the Access-Control-Al...

CVE-2026-61788

creationtimestamp| type| source ---|---|--- 2026-06-24 07:42:52+00:00| published-proof-of-concept| https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf 2026-09-25 12:30:32+00:00| seen| https://gist.github.com/alon710/dc5aa94f453805ed82e51ccb8dad1bc3...