CVE-2026-85788 - Issue with awslabs mysql-mcp-server
highvulnerability
security
Source: AWS Security BulletinsSeptember 9, 2026
Summary
A vulnerability was found in awslabs mysql-mcp-server (a Model Context Protocol server, which is software that helps AI models interact with MySQL databases) versions 1.0.21 and earlier. An attacker could bypass the read-only protection by using SQL inline comments (special text that gets ignored by the database), allowing them to run commands that should have been blocked. However, the read-only mode is only a basic safeguard, and the real protection depends on the database user permissions (access rules) that are set up.
Classification
Attack SophisticationTrivial
Impact (CIA+S)
integrity
AI Component TargetedAPI
Affected Vendors
Amazon
Related Issues
Monthly digest — independent AI security research
Original source: https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws/
First tracked: September 9, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 92%