Description

MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-15T15:17:19.947Z",
  "pubdate": "2026-09-15T15:17:19.947Z",
  "executiveSummary": "MySQL MCP Server prior to version 0.4.2 is susceptible to an unauthenticated Remote Code Execution (RCE) and database compromise vulnerability when configured with the SSE transport protocol.\nThe vulnerability stems from improper security configuration in the server's HTTP routing and transport initialization, allowing external attackers to bypass authentication entirely.\nBy leveraging the SSE transport, an attacker can access sensitive functions such as execute_sql without prior authentication, enabling arbitrary database queries.\nThe risk is critical, as successful exploitation permits unauthorized data disclosure, database modification, and, if the underlying MySQL account possesses FILE privileges, arbitrary server file read/write operations leading to potential code execution.\nThe issue affects deployments utilizing the SSE transport mode; the default stdio transport remains unaffected by this specific flaw.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure initialization of the SseServerTransport within src/mysql_mcp_server/server.py when the MCP_TRANSPORT environment variable is set to 'sse'.\nUnder this configuration, the transport object is instantiated without specifying 'security_settings' or enabling 'enable_dns_rebinding_protection'.\nSimultaneously, the Starlette application routes ('/', '/sse', and '/messages/') lack any form of authentication middleware or access control.\nBy default, the service binds to the 0.0.0.0 network interface, exposing these unauthenticated routes to any network-reachable entity.\nAttackers can exploit this via two primary vectors: direct network access to the exposed server endpoints or DNS rebinding.\nIn a DNS rebinding scenario, an attacker induces a victim's browser to perform cross-origin requests directed at the locally bound service, bypassing Same-Origin Policy (SOP) restrictions.\nOnce access is established, the attacker can supply arbitrary SQL queries directly to the cursor.execute(query) method.\nThe impact of executing arbitrary SQL is extensive; it grants the attacker full read and write access to the configured database.\nIf the database user configured for the MySQL MCP Server is granted FILE privileges, the attacker can leverage standard MySQL commands (e.g., LOAD_FILE, SELECT ... INTO OUTFILE) to interact with the host filesystem.\nThis allows for the extraction of sensitive system files or the placement of malicious artifacts (e.g., scripts or libraries) in system directories, which can subsequently be executed to achieve Remote Code Execution on the host operating system.\nThe vulnerability is explicitly present in versions prior to 0.4.2, where the transport and routing layers fail to enforce security boundaries for incoming SSE-based requests."
}