CVE-2026-61788 · GHSA-mwwr-p57h-56pf

@bytebase/dbhub's read-only mode does not prevent database writes

Risk score: 59/100
CVSS: 7.4 v3.1
Exploit chance (30 days): 0.3%
Published: 24 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the execute_sql tool does not make the connection read-only. The connectors are written to set PostgreSQL default_transaction_read_only=on (and open SQLite in readOnly mode), but…
Affected: @bytebase/dbhub (npm) < 0.22.6
Fix: Upgrade @bytebase/dbhub to 0.22.6 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@bytebase/dbhub: Amber, patch this week. DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by chec…

The flaws

CVE-2026-61788: @bytebase/dbhub's read-only mode does not prevent database writes (CVSS 7.4 · EPSS 0%)
CVE-2026-61742: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution (CVSS 9.3 · EPSS 0%)
GHSA-j656-3hf2-fvjc: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation (CVSS 6.1)

The fix

Upgrade @bytebase/dbhub: 0.22.6 · 0.22.5 or later on your release line

Who is exposed: @bytebase/dbhub (npm) <= 0.22.4

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-184 (CWE-184). 37 other warnings in 30 days

Why it is Yellow

CVSS 7.4 high
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@bytebase/dbhub	npm	< 0.22.6	0.22.6

References

Original description

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue.

Last activity 24 Sep 2026. Patch Forecast updates every hour.