Security Advisory

CVE-2026-79536 : Read-only mode bypass in bytebase/dbhub on MySQL and MariaDB

Severity

Critical

CVSS 3.1

9.1

Published

September 22, 2026

Back to advisories

Table of Contents

Advisory details

Product:

DBHub (github.com/bytebase/dbhub)

Affected versions:

v1.2.0 and earlier; later releases not assessed.

Patched version:

CVSS 3.1 vector:

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE:

CWE-863 Incorrect Authorization; CWE-89 SQL Injection; CWE-436 Interpretation Conflict

Publication status:

Pending publication on CVE.org

Summary

DBHub's read-only mode relies on a SQL classifier that misses # comments on MySQL and MariaDB. A hidden second statement can write to or drop tables.

Where the bug is

Tool: execute_sql in read-only mode
Classifier: src/utils/sql-parser.ts, function scanTokenMySQL
Connection: multipleStatements is enabled on the MySQL connection, and the SQL is passed to the driver exactly as classified

How it works

Read-only mode is a stated safety guarantee: writes and DDL are supposed to be refused before they reach the database. The classifier tokenizes the incoming SQL, splits it on statement separators, and inspects each statement to decide whether it reads or writes.

Because the MySQL scanner does not recognize # as a single-line comment, a #-prefixed region is parsed as a string, and that hides a following ;-separated statement from the classifier. The classifier sees only a harmless leading read and allows the request. MySQL and MariaDB treat # as a comment, so they see two statements and execute the hidden write or DDL. The connection allows multiple statements and the text is forwarded unchanged, so nothing downstream re-checks the decision.

A separate variant that uses backslash-escaped quotes was reported to the maintainers alongside this issue; it is outside the scope of CVE-2026-79536. The maintainers previously fixed a -- comment variant.

Exploitation requires network access to DBHub's HTTP transport but does not require authentication in the tested default configuration.

Impact

An MCP client, or an LLM driving one, can defeat read-only mode on a MySQL or MariaDB backend and run writes and destructive DDL, for example dropping tables or changing rows in a database the operator meant to expose read-only to agents.

How to fix it

Disable multipleStatements on the database connection, so stacked statements cannot run regardless of what the classifier decides.
Enforce read-only at the database itself, with a read-only transaction or a least-privilege database account, instead of relying only on the client-side classifier.
Fix the classifier so it parses # comments the same way the target dialect does in its default SQL mode.

Timeline

2026-07-14: Reported to the maintainer by Traceforce (the #-comment bypass).
2026-08-21: Reported via MITRE.
2026-08-27: Follow-up to the maintainers reporting a separate variant, outside this CVE's scope, and asking for a class-level fix.
2026-09-10: CVE ID assigned by MITRE.