Disclosed vulnerability
CVE-2026-59971: unauthenticated SQL execution in MySQL MCP Server SSE transport (no DNS-rebinding protection, binds 0.0.0.0)
AIR-2026-0239 AIR record · 2026-09-mysql-mcp-server-sse-unauth-sql
From the supporting source
A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query).github.com
The record
Disclosed
2026-09-11
Vendor
designcomputer
Product
mysql_mcp_server
Risk domain
Access control and permissions › Confused deputy
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target — unauthenticated MCP server flaw; agent tooling is the attacked endpoint
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Unauthenticated network request
Impact type
Unauthorized database access, Data exfiltration, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
mysql_mcp_server < 0.4.2 run in SSE mode; internet scanning found 25 publicly reachable SSE instances
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
mysql_mcp_server 0.4.2 (enables TransportSecuritySettings DNS-rebinding protection, recommends 127.0.0.1 bind)
Taxonomy & references
Curator notes
CVSS 10.0. GHSA-rqfv-2mw9-78g2 published 2026-09-11; CVE published 2026-09-15 (GitHub CNA). Discovered by Huanchen, SongWu (JHU), BrookeYangRui (JHU). Default stdio transport unaffected. FILE privilege enables LOAD_FILE/INTO OUTFILE read/write and potential RCE. No exploitation documented (25 exposed SSE instances found by scanning). Part of the 2026-09-16 CVE Brief MCP-server cluster.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-59971: unauthenticated SQL execution in MySQL MCP Server SSE transport (no DNS-rebinding protection, binds 0.0.0.0)". AIR, AIR-2026-0239. https://agentincident.vercel.app/i/AIR-2026-0239/ (accessed 2026-10-19).