TI-2026-44228 Aliases CVE-2026-61788 GHSA-mwwr-p57h-56pf

@bytebase/dbhub's read-only mode does not prevent database writes

HIGH 68CWE-184Published 2026-09-24 · Updated 2026-09-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.004 34th percentileScored 2026-11-07

Fix Fixed dbhub (bytebase): 0.22.6@bytebase/dbhub (npm): 0.22.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bytebase	dbhub	before 0.22.6	0.22.6	Patch available	CNA
—	@bytebase/dbhub (npm)	before 0.22.6	0.22.6	Patch available	GHSA-mwwr-p57h-56pf

dbhub Vendorbytebase Affected before 0.22.6 Fixed in 0.22.6 Patch available CNA
@bytebase/dbhub (npm) Vendor— Affected before 0.22.6 Fixed in 0.22.6 Patch available GHSA-mwwr-p57h-56pf

Remediation

Fix · CNA dbhub (bytebase) Fixed in 0.22.6
Fix · GHSA-mwwr-p57h-56pf @bytebase/dbhub (npm) Fixed in 0.22.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-61788
2026-10-03 Alias added: GHSA-mwwr-p57h-56pf

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-61788

Other 5

TI-2026-44186 DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution CVSS 4.0CRITICAL 9.3
TI-2026-83204 Read-only bypass in DBHub MySQL and MariaDB connectors via comments CVSS 4.0MEDIUM 6.1
TI-2022-13896 bytebase - Improper Authorization CVSS 3.1MEDIUM 4.3
TI-2022-13895 bytebase - Improper Authorization CVSS 3.1MEDIUM 4.3
TI-2022-26714 Authentication bypass in Bytebase GitLab self-hosted login CVSS 4.0CRITICAL 9.3
TI-2026-79259 Authorization bypass in Bytebase exposes other projects' task runs CVSS 4.0MEDIUM 5.3

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences