Vulnerabilities

TI-2026-83204 CVE-2026-61789 · GHSA-j55q-p8qc-f6wg

Read-only bypass in DBHub MySQL and MariaDB connectors via comments

MEDIUM 62

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.

CVSS 4.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00385 Published 2026-10-30 Fixed in 0.22.6 CWE-436

TI-2022-26714 CVE-2022-51026 · GHSA-ffpw-wpwq-rh9j

Authentication bypass in Bytebase GitLab self-hosted login

MEDIUM 49

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00613 Published 2026-10-22 Fixed in 1.0.1 CWE-290

TI-2026-79259 CVE-2026-115322 · GHSA-4vfr-m29p-8gpj

Authorization bypass in Bytebase exposes other projects' task runs

LOW 24

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00281 Published 2026-10-22 Fixed in 3.16.0 CWE-639

TI-2026-79258 CVE-2026-115321 · GHSA-27j2-crf8-3w95

Authorization bypass in Bytebase lets users overwrite other projects' comments

LOW 24

Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00284 Published 2026-10-22 Fixed in 3.16.0 CWE-639

TI-2026-44228 CVE-2026-61788 · GHSA-mwwr-p57h-56pf

@bytebase/dbhub's read-only mode does not prevent database writes

HIGH 68

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.004 Published 2026-09-24 Fixed in 0.22.6 CWE-184

TI-2026-44186 CVE-2026-61742 · GHSA-fm8p-53ww-hf6w

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

HIGH 81

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00201 Published 2026-09-24 Fixed in 0.22.5 CWE-306

TI-2022-13895 CVE-2022-32169 · GHSA-5rc4-v5mj-g8c4

bytebase - Improper Authorization

MEDIUM 53

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00663 Published 2022-09-28 No fix listed CWE-285

TI-2022-13896 CVE-2022-32170 · GHSA-9mmc-27gw-w6mq

bytebase - Improper Authorization

MEDIUM 53

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userI…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00663 Published 2022-09-28 No fix listed CWE-285

Vulnerabilities

Filters