SQL Validation Bypass in DBHub Database MCP Server for MySQL and MariaDB

CVE-2026-61789

What is CVE-2026-61789?

DBHub, a database MCP server for multiple database management systems, is vulnerable due to improper handling of read-only SQL validation bypass in its MySQL and MariaDB connectors. The issue arises from incorrect comment parsing in SQL statements where the system fails to appropriately identify a double dash as the start of a comment unless it is followed by specific characters. This flaw allows attackers to craft SQL statements that can bypass read-only checks and potentially execute harmful write or destructive DDL commands. This vulnerability impacts users who can inject SQL into the DBHub assistant, leading to unauthorized data modification or loss. The problem has been remediated in version 0.22.6.

References