MCP MySQL server exposed unauthenticated SQL access

CVE-2026-59971 gives an unauthenticated attacker full SQL access to any mysql_mcp_server running in SSE mode. Scanners found 25 of these servers reachable on the open internet, each one rated CVSS 10.

Run MCP_TRANSPORT=sse and the server builds its SseServerTransport without passing security_settings. That argument turns on the MCP Python SDK's DNS-rebinding protection, so skipping it leaves the protection off.

The server also skips CORS and TrustedHost middleware, leaves all three routes unauthenticated, and binds to 0.0.0.0 by default.

An attacker can call execute_sql directly over the network. Or they can rebind a victim's browser to 127.0.0.1 and proxy requests through it.

On a database with MySQL's FILE privilege enabled, that access extends past SQL. LOAD_FILE reads arbitrary files off disk, and INTO OUTFILE writes a webshell to one.

Version 0.4.2 turns DNS-rebinding protection on by default, closing the gap, per the GHSA advisory.

The advisory doesn't say how many of the 25 exposed instances also had FILE privilege enabled.