{"data":{"id":"0b2f6ebf-49ee-4c5e-bcd1-3171d73af92f","title":"GHSA-fm8p-53ww-hf6w: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution","summary":"DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint at /mcp when run with --transport http. Its origin check only compares Origin and Host hostnames for equality, so a DNS rebinding attack lets a malicious website invoke DBHub MCP tools from a victim's browser without prompt injection or model involvement. With a real configured database, this can read, enumerate, and potentially write database contents depending on configured tool permissions and credentials.","solution":"Suggested remediation: bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts. Add an explicit allowed-hosts policy instead of accepting arbitrary hosts (the source text is truncated at this point).","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-fm8p-53ww-hf6w","publishedAt":"2026-09-24T19:36:57.000Z","cveId":"CVE-2026-61742","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@bytebase/dbhub@<= 0.22.4 (fixed: 0.22.5)"],"affectedPackageNames":["@bytebase/dbhub"],"affectedPackageRefs":["npm:@bytebase/dbhub"],"affectedVendors":[],"affectedVendorsRaw":["DBHub","@bytebase/dbhub"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00201,"epssCheckedAt":"2026-11-10T00:11:23.085Z","kevDateAdded":null,"advisoryAliases":["GHSA-fm8p-53ww-hf6w"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-09-24T19:36:57.000Z","fixReleasedAt":"2026-06-24T04:22:32.697Z","daysToFix":-92,"fixCheckedAt":"2026-10-29T21:30:10.940Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@bytebase/dbhub","fixedVersion":"0.22.5","matchedVersion":"0.22.5","fixReleasedAt":"2026-06-24T04:22:32.697Z","daysToFix":-92,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:10.793Z"}]}}