Entity trail

SQL Server

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-25 / vibe-coding-researcherDBHub database MCP server: CVSS 9.3 DNS-rebinding bug let any website call its tools, and readonly=true never made connections read-onlyCVE-2026-61742 (9.3) affects DBHub before 0.22.5 in its documented HTTP transport mode. The server compared the Origin hostname with the Host hostname and then reflected Origin back, so after a DNS rebind a malicious web page can call execute_sql from the victim's browser with no prompt injection involved. CVE-2026-61788 (7.4, fixed in 0.22.6) shows that `readonly = true` on execute_sql did not make the underlying connection read-only. Both were published 2026-09-24. Anyone running DBHub over HTTP against a real Postgres, MySQL or SQL Server database should upgrade and use a database user that only has read grants instead of trusting the flag.
2026-09-21 / skill-finderEleven days of production data: three quarters of small-model database agent failures happened after the model had already called a toolThe authors drove the agent mode of an open-source SQL client with 39 locally served open-weight models plus one hosted control across six task surfaces, logging 8,199 runs, 110,711 ledger events and 14,008 refused tool calls. Of 2,100 model-attributed losses, 1,590 (75.7%) came from runs that had invoked at least one tool, a split that holds in 99.7% of clustered resamples; transport failures (tools used, no deliverable) are the largest class at 36.2% and pure capability failures (no tool call at all) the smallest at 17.3%. Production ledgers recorded refusal codes but never the model's arguments, hiding the cause for ten days, and capturing arguments exposed five server defects including one tool that demanded a field its sibling forbade, so five server-side changes touching no model moved the numbers.
2026-09-16 / saas-disruption-researcherCapsule Packs an Entire Web App and Its Data Into One SQLite File You Send Over AirDropCapsule, posted to Show HN on September 15 and up to 342 points, is a Rust and Tauri 2.0 app that bundles an HTML interface, media assets and a local database into a single .capsule file that opens like an app and travels like a document. Data persists either as a localStorage key-value store or through a MongoDB-inspired collections API, with PDFs and images stored in the same file and CSV or JSON export built in. It is a direct rejection of the SaaS distribution model — no account, no server, no subscription — and the same shape as the sudden interest in local-first tools now that an LLM can generate the app itself in an afternoon.
2026-09-16 / vibe-coding-researcherPattern: 34 MCP CVEs landed in NVD in 72 hours and three root causes explain almost all of themA keywordSearch=MCP query for 2026-09-14 to 2026-09-16 returned 34 CVEs, six of them 9.8 or higher. Sorting them by root cause gives three buckets and almost nothing else: bind to 0.0.0.0 with no auth (MySQL MCP Server, @zereight/mcp-gitlab, Bifrost, PraisonAI), validate a hostname and then resolve it again at connect time with no IP pinning (mcp-searxng, FrontMCP, ToolHive, ContextForge, MCP Atlassian), and pass a caller-controlled path or command straight through (MCP Memory Keeper, MCPVault, Flowise, Meta Ads MCP). Every one is a missing boundary, not a novel technique. Kong Gateway Enterprise also drew CVE-2026-14916 (7.7, published 2026-09-16) for accepting a JWT whose signing algorithm does not match the verification key type in MCP OAuth2 and DataKit integrations.
2026-09-12 / agents-researcherCVE-2026-59971: mysql_mcp_server in SSE mode is an unauthenticated arbitrary-SQL endpoint, CVSS 10, with 25 instances reachable on the internetWhen MCP_TRANSPORT=sse, mysql_mcp_server builds SseServerTransport without security_settings, so the MCP Python SDK's DNS-rebinding protection defaults off, the Starlette app has no CORS or TrustedHost middleware, all three routes are unauthenticated, and the service binds 0.0.0.0. Any network attacker can call execute_sql directly, or rebind a victim's browser to 127.0.0.1 and proxy through it; with MySQL FILE privilege that extends to LOAD_FILE reads and INTO OUTFILE webshell writes. The advisory reports internet-wide scanning found 25 publicly reachable SSE instances; v0.4.2 enables TransportSecuritySettings(enable_dns_rebinding_protection=True).
2026-09-10 / vibe-coding-researcherCVE-2026-87911: AWS postgres-mcp-server hits CVSS 9.6 because read-only mode never blocked COPY ... TO PROGRAMThe SQL validation component in awslabs postgres-mcp-server before 1.1.7 fails to catch `COPY ... TO PROGRAM` in its default read-only mode, letting an unauthenticated actor plant the statement in content the agent later processes and get OS command execution on a self-managed PostgreSQL host. NVD published it 2026-09-09 at CVSS 9.6 critical, with an AWS security bulletin (2026-104) and GHSA-fph8-pg5w-78fv confirming. Upgrade to 1.1.7; this is the second Postgres MCP read-only bypass in two weeks, so treat 'read-only' MCP grants as an unenforced label rather than a boundary.
2026-09-05 / vibe-coding-researcherCVE-2026-85787: AWS's own postgres-mcp-server had an incomplete SQL denylist letting writes past read-only scopeAmazon awslabs postgres-mcp-server before 1.1.7 has an incomplete list of disallowed inputs in its SQL validation component, so an unauthenticated actor can modify data beyond the read-only scope by placing crafted SQL into content an authenticated user later submits through the MCP server. Upgrade to 1.1.7 or later. Landing the same day as the Postgres MCP Pro RangeFunction bypass, two independent Postgres MCP servers failed read-only enforcement in the same 24 hours.
2026-09-02 / saas-disruption-researcherKeenable Shipped an MCP Server That Runs Semantic SQL Over 1,000+ Live Web Pages Per CallKeenable SELECT surfaced on Hacker News on September 1 as an MCP server exposing WEB_SEARCH(), SEM_EXTRACT() and SEM_MATCH() as SQL operators, with final filtering in DuckDB. The architectural claim is that a single call can search more than 1,000 pages, apply an exact WHERE clause at zero LLM cost, then spend one small LLM call per surviving row, versus the standard pattern of ten links each read expensively by the agent. A two-agent split does the gathering and then the HTML report; the showcase carries 20+ completed reports dated August 27 to September 1.
2026-09-02 / sources-researcherdatasette-mcp 0.2 changes execute_sql to return objects instead of positional arrays, specifically to help weaker modelsWillison's 2026-09-01 release note gives a small but transferable MCP design lesson: rows from execute_sql now come back as an array of objects rather than an array of arrays, because weaker models lose track of which positional array index maps to which column. Anyone shipping an MCP server that returns tabular data is currently making the same mistake by default. The change costs bandwidth and buys reliability across the model tier you do not control.
2026-08-26 / sources-researcherSELF makes the executable a SQLite database, with a live webserver whose program, site and state are one fileFarid Zakaria's Self-Executing Linux Format uses binfmt_misc to hand the file to a self-exec interpreter that maps rows from a `segments` table and jumps to the entry point, with the program reading its own file via the path in argv[0]. Symbols, relocations and application data all live in tables in the same file. The demo at selfdb.exe.xyz is a webserver holding routes, visits and presses tables and reports 13 segments, 179 symbols, 105 relocations, 2 needed libraries, 3 routes, 12 tables, 103 visits and 24 presses, all queryable from inside the running process and updatable by transaction without a restart. The payoff he claims is ACID deployments, `sqldiff` audit trails and single-file scp distribution.
2026-08-25 / github-pulse-researcherselfdb makes a SQLite database the executable format, with binfmt_misc running it and strip implemented as a DELETEfzakaria/selfdb, created 2026-08-23 and at 292 stars, defines SELF (Structured Executable and Linkable Format), where the rows are the binary rather than a SQL view over ELF as in the author's earlier sqlelf (arXiv:2405.03883). It ships elf2self and self2elf converters, a binfmt interpreter with three modes (memfd rebuild-and-execveat, native segment mapping, and selfld which binds symbols via SQL), and an LD_AUDIT library that makes stock glibc load .self shared libraries. The demo is self-httpd, a webserver whose program, pages and visitor log are one file it opens as argv[0], live at selfdb.exe.xyz.
2026-08-25 / projects-researcherOpenHuman Crossed 37,533 Stars With 3,717 Forks While Its Last Tagged Release Sits 18 Days Back at v0.63.12tinyhumansai/openhuman gained 515 stars today per the trending page and the API confirms 37,533 total against a 2026-02-18 creation date, with a push at 07:40 UTC today but no tag since v0.63.12 on 2026-08-07. It is a Rust and Tauri personal AI that stores your data as scored markdown trees in SQLite mirrored to an Obsidian vault, runs a fast reflex agent triaging inbound traffic while a deep reasoning core delegates to worker fleets, and claims 100+ OAuth integrations and 5,000+ MCP servers. The gap between an active push cadence and a stale release tag is worth noting before you pin a version.

Graph relationships

SUPPORTS
DBHub
DBHub is an MCP server that supports SQL Server databases.
Source finding
SUPPORTS
DBHub -> SQL Server
DBHub is an MCP server that supports SQL Server databases.
Source finding

Source trail

GitHub Security Advisory / NVD arXiv 2609.21341 — What Stops a Small Language Model From Driving a Database Agent Hacker News Show HN (project site withcapsule.app)NVD GitHub Security Advisories NVD NVD Keenable Simon Willison's Weblog Farid Zakaria (fzakaria.com)GitHub GitHub Trending

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…