MySQL MCP Server Vulnerability: Unauthenticated SQL Execution Risk
- Severity
- HIGH
- Affected component
- mysql-mcp-server (pypi)
- Affected versions
- < 0.3.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2 or < 0.3.0 or >= 0.1.0, <= 0.1.0 or >= 0.1.2, <= 0.1.2 or >= 0.2.0, <= 0.2.0 or >= 0.2.1, <= 0.2.1 or >= 0.2.2, <= 0.2.2
- Patched version
- v0.4.2
An early warning has been issued for a vulnerability in the mysql-mcp-server pip package that may allow unauthenticated SQL execution due to missing origin/host validation in SSE transport.
What happened
An early warning has been issued for a vulnerability in the mysql-mcp-server pip package. This vulnerability, tracked as GHSA-RQFV-2MW9-78G2, reportedly allows unauthenticated SQL execution due to missing origin/host validation in SSE transport. This can potentially lead to full data dump, arbitrary file read/write, and remote code execution (RCE). The vulnerability is under investigation and has not been exploited in the wild as of the latest reports.
The affected versions of mysql-mcp-server are complex and include multiple ranges. Specifically, versions less than 0.3.0 or within certain ranges between 0.1.0 and 0.2.2 are reportedly vulnerable. The vulnerability is patched in version 0.4.2 and later. Users of affected versions should take immediate action to upgrade.
What to do about it
- Upgrade to mysql-mcp-server version 0.4.2 or later to mitigate the vulnerability.
- Review your project dependencies to identify any use of mysql-mcp-server and assess the version for vulnerability.
- If you are using an affected version, plan and execute an upgrade to a patched version as soon as possible.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
mysql-mcp-server is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using mysql-mcp-server in versions less than 0.3.0 or within the specified vulnerable ranges between 0.1.0 and 0.2.2.
What should I do right now?
Immediately upgrade to mysql-mcp-server version 0.4.2 or later to mitigate the vulnerability.
Is there an official fix available?
Yes, version 0.4.2 and later are patched.