Description

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as whitespace. To remediate this issue, users should upgrade to version 1.0.23.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-09T17:17:49.937Z",
  "pubdate": "2026-09-09T17:17:49.937Z",
  "executiveSummary": "The awslabs mysql-mcp-server is vulnerable to a security bypass within its mutable SQL detector component, which serves as a read-only enforcement gate. Due to an incomplete list of disallowed inputs, context-dependent actors can circumvent this safety mechanism. The vulnerability is rooted in how the internal regular expression engine handles SQL inline comments, failing to recognize certain comment patterns as whitespace. This parsing discrepancy allows specially crafted queries to evade detection.\nBy successfully bypassing the read-only gate, unauthorized actors can execute restricted database operations, including reaching sensitive file-read and file-write SQL sinks. This capability presents severe security implications, as it allows attackers to read or write arbitrary files on the underlying database server host. To resolve this vulnerability and restore proper query containment, users must upgrade their deployments to version 1.0.23.",
  "technicalDetails": "The vulnerability exists within the input validation and normalization phase of the mutable SQL detector in Amazon awslabs mysql-mcp-server. This component is designed to parse incoming SQL statements and block any queries containing mutable operations or restricted functions, acting as a policy enforcement point for read-only database connections.\nThe root cause of the bypass is an inconsistency between how the detector's regex engine and the backend MySQL database engine interpret SQL inline comments. In SQL, inline comments (such as those enclosed in C-style comment syntax) are semantically treated as whitespace. However, the detector's regular expression patterns contain an incomplete specification of allowed whitespace characters and comment formats.\nWhen processing a query containing specific inline comments, the detector's regex engine fails to classify the comment sequences as whitespace. Consequently, it tokenizes the input query incorrectly, merging restricted keywords with the unrecognized comment delimiters into a single token. Because this merged token does not match any blacklisted keywords in the disallowed inputs list, the detector classifies the query as benign and permits its passage.\nWhen the query reaches the backend MySQL database, the database parser correctly identifies the inline comments as whitespace, separates the tokens, and executes the underlying commands. This enables an attacker to invoke restricted SQL sinks, such as those facilitating file-read (e.g., LOAD_FILE()) and file-write (e.g., INTO OUTFILE) capabilities. The mismatch in parser behavior effectively nullifies the read-only guarantees of the gateway, leading to potential data exfiltration and arbitrary file creation."
}