DNS Rebinding Flaw in DBHub HTTP Mode Allows Unauthenticated Browser-Origin SQL Execution

What happened

A security advisory (GHSA-fm8p-53ww-hf6w, tracked as CVE-2026-61742) discloses a DNS rebinding vulnerability in DBHub, an MCP (Model Context Protocol) server for database access. When DBHub 0.21.2 is run with its documented HTTP transport mode (--transport http), it attempts to block cross-origin browser requests by checking that the Origin header's hostname matches the Host header's hostname. According to the advisory, this check only verifies equality between the two headers rather than validating against an explicit allow-list, so an attacker who rebinds a domain they control to the victim-accessible DBHub address can make both headers match — with the attacker's own hostname. A published proof-of-concept reportedly demonstrates that this lets a malicious web page invoke DBHub's MCP tools, including execute_sql, from a victim's browser with no authentication token or prompt injection involved.

Why it matters for defenders

DBHub's HTTP transport is opt-in (the default transport is stdio), but the advisory notes it's a documented mode for web clients, shared servers, and remote access — meaning any organization that exposed a DBHub instance over HTTP for convenience could have effectively left a browser-reachable path into their database. Per the advisory, the practical impact depends on the configured database and tool permissions: at minimum the demo SQLite database is exposed, and with a production database connected, the same primitive could enable read, enumeration, and potentially write access. No compromised AI client or model involvement is required — this is a pure web/browser-based access control bypass.

What defenders should watch for or do now

• Inventory any DBHub deployments and confirm which transport mode is in use; if HTTP transport is running, verify it is bound to 127.0.0.1 or otherwise not reachable from browsers outside the intended MCP client.
• Restrict or firewall access to DBHub HTTP endpoints (default port patterns, /mcp path) so they are not reachable from general user browsing networks.
• Review DBHub's configured database credentials and tool permissions — favor least-privilege/read-only configurations for execute_sql where HTTP transport must remain enabled.
• Watch for anomalous /mcp JSON-RPC requests with mismatched or unusual Origin/Host header pairings in proxy or web server logs where DBHub HTTP mode is fronted.
• Track upstream remediation from the DBHub maintainers (the advisory suggests loopback-only binding by default, explicit allowed-host/origin policies, and authentication tokens for /mcp) and apply patches once released.

Developing intel

This is a same-day advisory with a public proof-of-concept and no confirmed patch status noted at time of writing. Details may evolve as the DBHub maintainers respond. For the full technical writeup and PoC, see the original advisory: GHSA-fm8p-53ww-hf6w.