CVE-2026-59971: mysql_mcp_server in SSE mode is an unauthenticated arbitrary-SQL endpoint, CVSS 10, with 25 instances reachable on the internet

GitHub Security Advisories·high signalXBlueskyLinkedInCopy link

When MCP_TRANSPORT=sse, mysql_mcp_server builds SseServerTransport without security_settings, so the MCP Python SDK's DNS-rebinding protection defaults off, the Starlette app has no CORS or TrustedHost middleware, all three routes are unauthenticated, and the service binds 0.0.0.0. Any network attacker can call execute_sql directly, or rebind a victim's browser to 127.0.0.1 and proxy through it; with MySQL FILE privilege that extends to LOAD_FILE reads and INTO OUTFILE webshell writes. The advisory reports internet-wide scanning found 25 publicly reachable SSE instances; v0.4.2 enables TransportSecuritySettings(enable_dns_rebinding_protection=True).