CVE-2026-59971

vulnfeed.it • September 12, 2026

Share: View original

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

pip/mysql-mcp-server < 0.4.2

Remediation Resources

Related Vulnerabilities

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-59971: Unauthenticated SQL Execution in MySQL MCP Server A critical vulnerability, CVE-2026-59971, has been identified in the MySQL MCP Server affecting versions prior to 0.4.2. The flaw allows unauthenticated SQL execution due to missing Origin/Host validation in SSE transport. Attackers can exploit this vulnerability via DNS rebinding or direct exposure, potentially leading to unauthorized access and data manipulation. The vulnerability impacts various systems utilizing the MySQL MCP Server, and remediation resources are available. Security professionals are urged to assess their systems and apply necessary updates to mitigate risk. 2 sources 69

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

CWE-287 - Improper Authentication Cwe-89 - SQL Injection

Platforms (1)

MySQL MCP Server