Database MCP Server Vulnerability in DBHub by Bytebase

CVE-2026-61788

What is CVE-2026-61788?

DBHub, a database management control program, has a significant vulnerability that affects its ability to enforce read-only settings for database connections. Prior to version 0.22.6, setting readonly = true on the execute_sql tool does not successfully restrict the connection to read-only. Although the system is designed to set PostgreSQL to default_transaction_read_only=on and to open SQLite in read-only mode, these protections are controlled by a configuration value that is not populated. As a result, users can execute statements that modify the database, allowing unauthorized actions such as sequence tampering and, for privileged users, the potential for remote code execution and file system access. The HTTP transport is also unauthenticated and binds to 0.0.0.0, creating a high risk for network-based exploitation. Version 0.22.6 addresses these issues.

References