MySQL MCP Server SSE Transport Missing Origin/Host Validation - Unauthenticated SQL Execution (CVE-2026-59971)

let mcpPaths = dynamic(["/sse", "/messages", "/message", "/mcp"]);
let privateHosts = dynamic(["localhost", "127.0.0.1", "::1"]);
CommonSecurityLog
| where DeviceVendor has_any ("Zscaler", "Palo Alto", "nginx", "F5") or isnotempty(RequestURL)
| extend Path = tostring(parse_url(RequestURL).Path)
| where Path has_any (mcpPaths)
| extend OriginHdr = tostring(AdditionalExtensions)
| where RequestMethod in ("POST", "GET")
| where (isnotempty(RequestClientApplication) and RequestClientApplication !has "mcp")
    or SourceIP !startswith "127." 
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, Path, RequestMethod, RequestClientApplication, OriginHdr
| order by TimeGenerated desc

index=proxy OR index=web sourcetype IN ("nginx:plus:kv", "access_combined", "suricata")
| rex field=uri_path "(?<mcp_path>/sse|/messages|/message|/mcp)"
| search mcp_path=*
| eval origin_host=coalesce(http_origin, host)
| eval suspicious_origin=if(isnull(http_origin) OR NOT match(http_origin, "(localhost|127\.0\.0\.1|\[::1\])"), 1, 0)
| where suspicious_origin=1 OR NOT match(src_ip, "^127\.")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(http_method) as methods by src_ip dest_ip dest_port http_origin
| sort - count

sequence by source.ip with maxspan=30s
  [network where url.path in ("/sse", "/messages", "/message", "/mcp") and http.request.method in ("GET", "POST") and not (http.request.headers.origin like "*localhost*" or http.request.headers.origin like "*127.0.0.1*")]
  [network where url.path in ("/messages", "/message", "/mcp") and http.request.body.content : "*tools/call*execute_sql*"]

SELECT sourceip, destinationip, destinationport, "URL" AS url, "HTTP Method" AS method, "Origin" AS origin_header, QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Squid') 
  AND ("URL" ILIKE '%/sse%' OR "URL" ILIKE '%/messages%' OR "URL" ILIKE '%/mcp%')
  AND ("Origin" IS NULL OR ("Origin" NOT ILIKE '%localhost%' AND "Origin" NOT ILIKE '%127.0.0.1%'))
  AND sourceip NOT LIKE '127.%'
LAST 24 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*web*
| parse regex "(?<method>GET|POST)\s(?<uri>\S+)"
| where uri matches /\/(sse|messages|message|mcp)/
| parse regex "Origin:\s(?<origin>\S+)" nodrop
| where isNull(origin) OR (!(origin matches /.*localhost.*/) AND !(origin matches /.*127\.0\.0\.1.*/))
| where !(src_ip matches /127\..*/)
| count by src_ip, dest_ip, uri, method, origin
| sort by _count

rule mysql_mcp_sse_missing_origin_cve_2026_59971 {
  meta:
    author = "argus"
    description = "Detects unauthenticated access to mysql-mcp-server SSE endpoints via missing/invalid Origin header"
    cve = "CVE-2026-59971"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.referral_url, `/(sse|messages|message|mcp)`) or re.regex($e.target.url, `/(sse|messages|message|mcp)`)
    $e.network.http.method = /GET|POST/
    not re.regex($e.network.http.user_agent, `(localhost|127\.0\.0\.1)`)
    $ip = $e.principal.ip
  match:
    $ip over 5m
  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| in(field="RemotePort", values=["5000", "8000", "3000", "8080"])
| HttpPath=/\/(sse|messages|message|mcp)/
| HttpMethod=/GET|POST/
| case {
    HttpOrigin=/localhost|127\.0\.0\.1/ | OriginOk := "yes";
    * | OriginOk := "no";
  }
| OriginOk="no"
| groupBy([aid, RemoteAddressIP4, HttpPath], function=count())