https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:07:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-59971 <p><strong>Affected:</strong> designcomputer mysql_mcp_server</p> <p>MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim&#39;s browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.</p> <p><strong>Affected:</strong> designcomputer mysql_mcp_server</p> <p>MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim&#39;s browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-59971 https://cve.radiocsirt.org/vuln/ghsa-rqfv-2mw9-78g2 <p><strong>Affected:</strong> PyPI: mysql-mcp-server</p> <p>## Summary</p> <p>In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_settings`. As a result, the MCP Python SDK&#39;s DNS-rebinding protection (Origin/Host header validation) is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service binds to `0.0.0.0` by default with no authentication on any route.</p> <p>**Trigger condition:** `MCP_TRANSPORT=sse`. The default stdio mode is not affected.</p> <p>## Attack Scenarios</p> <p>**Scenario A — Direct exposure:** Any network attacker can invoke `execute_sql` to run arbitrary SQL without credentials → full data dump, and via MySQL `FILE` privileges, arbitrary file read/write and RCE.</p> <p>**Scenario B — DNS rebinding (local bind):** An attacker lures a victim&#39;s browser to a malicious page, rebinds their domain to `127.0.0.1`, and uses the browser as a proxy to invoke `execute_sql` as same-origin.</p> <p>## Root Cause</p> <p>In `src/mysql_mcp_server/server.py`:</p> <p>1. `SseServerTransport` is constructed without `security_settings` — the SDK defaults `enable_dns_rebinding_protection` to `False`. 2. The Starlette app has no CORS or TrustedHost middleware. 3. All three routes (`/`, `/sse`, `/messages/`) are unauthenticated. 4. The service binds to `0.0.0.0` by default. 5. The sink is `cursor.execute(query)` with a fully attacker-controlled query.</p> <p>## Impact</p> <p>- Unauthenticated arbitrary SQL execution against the configured database - Full data exfiltration and modification - If the MySQL account h…</p> <p><strong>Affected:</strong> PyPI: mysql-mcp-server</p> <p>## Summary</p> <p>In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_settings`. As a result, the MCP Python SDK&#39;s DNS-rebinding protection (Origin/Host header validation) is disabled; the Starlette application has no CORS or TrustedHost middleware; and the service binds to `0.0.0.0` by default with no authentication on any route.</p> <p>**Trigger condition:** `MCP_TRANSPORT=sse`. The default stdio mode is not affected.</p> <p>## Attack Scenarios</p> <p>**Scenario A — Direct exposure:** Any network attacker can invoke `execute_sql` to run arbitrary SQL without credentials → full data dump, and via MySQL `FILE` privileges, arbitrary file read/write and RCE.</p> <p>**Scenario B — DNS rebinding (local bind):** An attacker lures a victim&#39;s browser to a malicious page, rebinds their domain to `127.0.0.1`, and uses the browser as a proxy to invoke `execute_sql` as same-origin.</p> <p>## Root Cause</p> <p>In `src/mysql_mcp_server/server.py`:</p> <p>1. `SseServerTransport` is constructed without `security_settings` — the SDK defaults `enable_dns_rebinding_protection` to `False`. 2. The Starlette app has no CORS or TrustedHost middleware. 3. All three routes (`/`, `/sse`, `/messages/`) are unauthenticated. 4. The service binds to `0.0.0.0` by default. 5. The sink is `cursor.execute(query)` with a fully attacker-controlled query.</p> <p>## Impact</p> <p>- Unauthenticated arbitrary SQL execution against the configured database - Full data exfiltration and modification - If the MySQL account h…</p> https://cve.radiocsirt.org/vuln/ghsa-rqfv-2mw9-78g2