Skip to content
OpenAdvisories

Product · bytebase

dbhub

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-61742

    DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

    DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The…

    bytebase dbhub @bytebase/dbhub npm