ProxySQL MCP run_sql_readonly bypasses read-only contract via multi-statement execution (GHSA-7wh6-2vcc-gcm4)

Vulnerability Overview ProxySQL's GenAI/MCP tool violates its documented read-only contract for MySQL targets. The tool validates the entire input string using only a substring blacklist and a whitelist of the first keyword, then executes the entire SQL string on the backend connection using . Consequently, an attacker can submit a read-only first statement followed by a side-effect second statement, such as . The validator accepts the payload because it starts with , and side-effect MySQL statements like , , , , and are not rejected by the blacklist. In live MCP runtime testing, the endpoint accepted a request containing: The MCP response reported success for the first , and direct backend verification showed that the table had indeed been renamed. This violates the read-only security contract of the endpoint and allows MCP callers to execute backend write or administrative SQL, constrained only by the database permissions of the configured MCP target account. Impact Scope Affected Software: ProxySQL Affected Versions: >= 4.0.6, <= 4.0.8 Patched Version: 4.0.9 Remediation Recommended Fixes: - Do not use for backend connections. - Treat semicolons as invalid unless a true SQL parser is used in to separate and classify each statement. - Reject multi-statement inputs before execution. - Replace substring blacklist validation with parser-based SQL classification. - Enforce a per-statement read-only policy, not just at the beginning of the entire input. - Apply true parser-based backend verification for , particularly for PostgreSQL . - If multi-statement support is intentionally required, drain all results from the pool using before returning the connection. - Prefer database-level read-only credentials; tool-level validators should not be the sole enforcement boundary. - For PostgreSQL targets, prefer or other single-statement execution paths, as accepts multi-command strings. Immediate Operator Mitigations (until code fixes are available): - Disable MCP unless necessary. - Set a non-empty token before exposing . - Limit the network exposure of the MCP listener. - Configure MCP backend target credentials as database-level read-only users. - Add temporary MCP query rules to block obvious multi-statement patterns, such as semicolons, accepting potential false positives until a parser-based backend fix is available. This should only be considered a temporary mitigation, not a replacement for a full SQL parser. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

ProxySQL MCP run_sql_readonly bypasses read-only contract via multi-statement execution (GHSA-7wh6-2vcc-gcm4)

More from this source