GHSA-fm8p-53ww-hf6w: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary

DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint at /mcp when run with --transport http. Its origin check only compares Origin and Host hostnames for equality, so a DNS rebinding attack lets a malicious website invoke DBHub MCP tools from a victim's browser without prompt injection or model involvement. With a real configured database, this can read, enumerate, and potentially write database contents depending on configured tool permissions and credentials.

Mitigation

Suggested remediation: bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts. Add an explicit allowed-hosts policy instead of accepting arbitrary hosts (the source text is truncated at this point).

Topics

• Model Context Protocol

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News