MySQL MCP Server SSE Mode Allows Unauthenticated SQL Execution — CVE-2026-59971 (CVSS 10.0)

A critical advisory (GHSA-rqfv-2mw9-78g2, tracked as CVE-2026-59971, CVSS 10.0) discloses a missing Origin/Host validation flaw in mysql_mcp_server's SSE/HTTP transport mode.

What happened

According to the advisory, when MCP_TRANSPORT=sse is set, mysql_mcp_server constructs SseServerTransport without passing security_settings, leaving the MCP Python SDK's DNS-rebinding protection disabled. The Starlette application adds no CORS or TrustedHost middleware, all three routes (/, /sse, /messages/) are unauthenticated, and the service binds to 0.0.0.0 by default. The sink is a direct cursor.execute(query) call with a fully attacker-controlled query. The default stdio transport is not affected. The researchers reportedly identified 25 publicly reachable SSE instances via internet-wide scanning, and a PoC is public.

Why it matters

Per the advisory, this enables unauthenticated arbitrary SQL execution via the execute_sql tool — either directly against internet-exposed instances, or through a DNS-rebinding attack that turns a victim's browser into a same-origin proxy against a locally bound instance. Impact ranges from full database read/write to, if the configured MySQL account holds FILE privilege, arbitrary file read/write and potential RCE via webshell drop. Any organization running mysql_mcp_server in SSE mode — especially internet-facing or bound to 0.0.0.0 — is affected.

What to watch for / do now

• Check whether any deployments run mysql_mcp_server with MCP_TRANSPORT=sse, and upgrade to v0.4.2 or later, which enables DNS-rebinding protection by default.
• Bind SSE instances to 127.0.0.1 rather than 0.0.0.0, per the vendor's updated guidance, and place any necessary remote access behind authentication and a reverse proxy.
• Review the MySQL account's privileges used by the MCP server — remove FILE privilege unless explicitly required.
• Hunt for unexpected inbound connections to MCP SSE ports (default MCP SSE endpoints, e.g. /sse and /messages/) from unfamiliar external sources, and for anomalous or bulk execute_sql-style query patterns in MySQL general/audit logs.
• Treat any exposed MCP server (not just this one) as a high-value target — audit other self-hosted MCP tooling for the same missing Origin/Host validation pattern.

This is developing, same-day intel based on a newly published GHSA advisory; details may be refined as more deployments are assessed. See the original advisory for full technical detail: GHSA-rqfv-2mw9-78g2.