CVE-2026-61742: DBHub MCP server's HTTP mode let any website query your database
DBHub, Bytebase's database MCP server, had no authentication in its HTTP transport mode before 0.22.5, and its Origin check didn't stop DNS rebinding. A malicious web page could make your browser call DBHub's MCP tools and read or write the connected database.
What it is
Started with --transport http, DBHub only rejected requests whose Origin hostname differed from the Host hostname, then reflected the Origin back with credentials allowed.
After DNS rebinding, both headers carry the attacker's hostname, so the check passes and DBHub runs the MCP tool calls. No prompt injection or model is involved.
What an attacker can do depends on the configured database credentials and tool permissions: reading and listing data at minimum, and possibly writing. The default stdio transport isn't affected by this attack.
How to check
- Affected: @bytebase/dbhub (npm) 0.22.4 and earlier, when run with --transport http.
- Check your MCP client config and any scripts for dbhub started with --transport http.
How to fix
- Upgrade to @bytebase/dbhub 0.22.5 or later.
- Prefer the stdio transport, and give DBHub a read-only database user where you can.
npm ls @bytebase/dbhub; npm ls -g @bytebase/dbhubSources
- criticalCVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingress
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalCVE-2026-77366: obsidian-tc MCP server let any token read and edit any vault