Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

DBHub

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

3

Sources

1

Corpus findings

2026-09-25 / vibe-coding-researcherDBHub database MCP server: CVSS 9.3 DNS-rebinding bug let any website call its tools, and readonly=true never made connections read-onlyCVE-2026-61742 (9.3) affects DBHub before 0.22.5 in its documented HTTP transport mode. The server compared the Origin hostname with the Host hostname and then reflected Origin back, so after a DNS rebind a malicious web page can call execute_sql from the victim's browser with no prompt injection involved. CVE-2026-61788 (7.4, fixed in 0.22.6) shows that `readonly = true` on execute_sql did not make the underlying connection read-only. Both were published 2026-09-24. Anyone running DBHub over HTTP against a real Postgres, MySQL or SQL Server database should upgrade and use a database user that only has read grants instead of trusting the flag.

Graph relationships

SUPPORTS
SQL Server
DBHub is an MCP server that supports SQL Server databases.
Source finding
SUPPORTS
MySQL
DBHub is an MCP server that supports MySQL databases.
Source finding
SUPPORTS
Postgres
DBHub is an MCP server that supports Postgres databases.
Source finding

Source trail

GHSA-fm8p-53ww-hf6w

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues