Read the docs
TI-2026-09958 Aliases CVE-2026-11529GHSA-mvq4-39wx-6h5g

designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection

Priority MEDIUM 57CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_server/server.py of the component mysql URI Handler. This manipulation of the argument uri_str causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.3.0 is sufficient to resolve this issue. Patch name: 080bef9a96d625ce0dfbde573a08b93497871981. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed mysql-mcp-server (designcomputer): 0.3.0mysql-mcp-server (PyPI): 0.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
designcomputermysql-mcp-server0.2.0; 0.2.1; 0.2.20.3.0Patch availableCNA
—mysql-mcp-server (PyPI)before 0.3.00.3.0Patch availableGHSA-mvq4-39wx-6h5g
  • mysql-mcp-server Vendordesigncomputer Affected 0.2.0; 0.2.1; 0.2.2 Fixed in 0.3.0 Patch available CNA
  • mysql-mcp-server (PyPI) Vendor— Affected before 0.3.0 Fixed in 0.3.0 Patch available GHSA-mvq4-39wx-6h5g

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:designcomputer:mysql-mcp-server:*:*:*:*:*:*:*:*——designcomputer
  • cpe:2.3:a:designcomputer:mysql-mcp-server:*:*:*:*:*:*:*:* Versions — — ·designcomputer

Remediation

  • Fix · CNA mysql-mcp-server (designcomputer) Fixed in 0.3.0
  • Fix · GHSA-mvq4-39wx-6h5g mysql-mcp-server (PyPI) Fixed in 0.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11529
  2. 2026-10-03 Alias added: GHSA-mvq4-39wx-6h5g

References

Exploit 1

Patch 3

Advisory 1

Other 1

  • TI-2026-42764 Missing authentication in designcomputer mysql_mcp_server CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences