CVE-2026-59971— MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
Quick assessment
Affected
designcomputer mysql_mcp_server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MySQL MCP Server 是一个支持通过模型上下文协议（Model Context Protocol, MCP）安全交互 MySQL 数据库的服务端。在 0.4.2 版本之前，当设置 时， 文件在构建 时未配置 或未启用 ，同时 Starlette 路由 、 和 均未实施身份认证，且服务默认绑定到 。 这使得网络攻击者可以直接访问 功能，或者利用 DNS 重绑定（DNS Rebinding）技术，诱使受害者的浏览器向本地绑定的服务发起同源请求，并传入能够到达 的 SQL 查询语句。由此可导致未经身份认证的情
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-59971
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
Source: CVE Program / CVE List V5
Vulnerability Description
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| designcomputer | mysql_mcp_server | < 0.4.2 | - |
|
II. Public POCs for CVE-2026-59971
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59971
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59971 (1)
Vendor Advisories for CVE-2026-59971 (1)
Vendor Pages for CVE-2026-59971 (1)
Other References for CVE-2026-59971 (1)
IV. Related Vulnerabilities
Same weakness: CWE-306
-
CVE-2026-18111
Concrete CMS below 9.5.4 allows privilege escalation because -
CVE-2026-59160
Yeger: Unauthenticated Network-Exposed Turborepo Task Execut -
CVE-2026-91996
lamp-cloud through 5.10.0 Missing Authentication for JVM Pro -
CVE-2026-57140
PraisonAI AgentOS exposes unauthenticated agent listing and -
CVE-2026-57139
PraisonAI MCPServer exposes unauthenticated HTTP tools/call
V. Comments for CVE-2026-59971
No comments yet