What is the CVSS score of CVE-2026-48774?

CVE-2026-48774 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of ProxySQL are affected by CVE-2026-48774?

ProxySQL versions 3.0.0 through 3.0.8 contain an input validation flaw allowing MCP callers to bypass read-only SQL constraints and execute administrative or write operations against backend…. A patch is available.

How to fix or mitigate CVE-2026-48774?

Within 24 hours: Identify all ProxySQL 3.0.0-3.0.8 instances and assess network accessibility of the /mcp/query endpoint. Within 7 days: Implement firewall rules restricting /mcp/query access to trusted sources only, and reduce database account privileges for MCP backend connections to minimum necessary rights. Within 30 days: Monitor ProxySQL upstream releases for patch availability and prepare upgrade plan; conduct comprehensive access control audit of all MCP-connected databases.

ProxySQL CVE-2026-48774

EUVD-2026-38075 HIGH

Improper Input Validation (CWE-20)

2026-06-19 GitHub_M

PostgreSQL Information Disclosure Proxysql

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.6 HIGH

Network-reachable MCP endpoint, trivial multi-statement payload, unauthenticated when default auth token is empty; integrity high (writes/DDL), confidentiality low and availability low via KILL/SHUTDOWN within account grants.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 19, 2026 - 21:02 EUVD

Source Code Evidence Fetched

Jun 19, 2026 - 20:18 vuln.today

Analysis Generated

Jun 19, 2026 - 20:18 vuln.today

DescriptionCVE.org

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP run_sql_readonly tool violates its documented read-only contract for MySQL targets. The tool validates only the full input string with a substring blacklist and first-keyword allowlist, but then executes the entire SQL string on a backend connection created with CLIENT_MULTI_STATEMENTS. As a result, a caller can submit a read-only first statement followed by a side-effecting second statement, such as SELECT 1; RENAME TABLE .... The validator accepts the payload because it starts with SELECT and because side-effecting MySQL statements such as RENAME TABLE, SET, RESET, LOCK TABLES, and KILL are not rejected by the blacklist. In a live MCP runtime test, the /mcp/query endpoint accepted a run_sql_readonly request. The MCP response reported success for the first SELECT, and direct backend verification showed that the table had actually been renamed. This violates the endpoint's read-only security contract and lets an MCP caller perform backend writes or administrative SQL, limited by the configured MCP target account's database privileges. Version 3.0.9 contains a fix. Other operator mitigations include: keeping MCP disabled unless required; setting a non-empty mcp-query_endpoint_auth token before exposing /mcp/query; restricting MCP listener network exposure; configuring MCP backend target credentials as database-level read-only users; and adding temporary MCP query rules to block obvious multi-statement patterns.

Articles & Coverage 1

News 3 New PostgreSQL Vulnerabilities - 2 Critical, 1 High Severity Jun 20, 2026

AnalysisAI

Improper input validation in ProxySQL versions 3.0.0 through 3.0.8 lets MCP callers bypass the GenAI run_sql_readonly tool's read-only contract by submitting multi-statement payloads such as SELECT 1; RENAME TABLE x TO y, which execute in full because the backend connection enables CLIENT_MULTI_STATEMENTS. An attacker reaching the /mcp/query endpoint can perform writes and administrative SQL up to the privileges of the configured MCP backend account. No public exploit identified at time of analysis, though the upstream advisory documents a successful live test against the endpoint.

Technical ContextAI

ProxySQL is a high-performance proxy for MySQL/PostgreSQL backends. The newly-introduced GenAI/MCP plugin exposes a run_sql_readonly tool over an HTTP /mcp/query endpoint intended for use by LLM agents. Per the commit at sysown/proxysql@e32b7fd, the pre-fix validator (validate_readonly_query / is_dangerous_query in plugins/genai/src/tool_handlers/MySQL_Tool_Handler.cpp) only inspected the full input string with a substring blacklist plus a first-keyword allowlist, but the backend connection pool was initialised with the libmysqlclient CLIENT_MULTI_STATEMENTS flag. The MySQL server therefore happily executed every ;-separated statement after the validator approved the payload based on the leading SELECT. Compounding the gap, side-effecting verbs such as RENAME, FLUSH, RESET, LOCK, UNLOCK, KILL, OPTIMIZE, REPAIR, HANDLER, INSTALL, PURGE, SHUTDOWN, and transaction-control keywords were absent from the blacklist, and explain_sql blindly prefixed EXPLAIN to attacker SQL with no validation at all. Root cause maps to CWE-20 (Improper Input Validation), specifically a parser-vs-executor mismatch where one component validates a single-statement view while another executes the multi-statement reality. Affected CPE: cpe:2.3:a:sysown:proxysql:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: ProxySQL 3.0.9 - upgrade per advisory GHSA-7wh6-2vcc-gcm4 (https://github.com/sysown/proxysql/security/advisories/GHSA-7wh6-2vcc-gcm4) which corresponds to fix commit e32b7fd that disables CLIENT_MULTI_STATEMENTS on MCP backend connections, broadens the dangerous-keyword blacklist (RENAME, FLUSH, RESET, LOCK/UNLOCK, KILL, OPTIMIZE, REPAIR, HANDLER, INSTALL/UNINSTALL, PURGE, SHUTDOWN, transaction control, ANALYZE, etc.), adds a lexer-aware multi-statement detector, and applies the same validation to explain_sql. If immediate upgrade is not possible, keep the MCP plugin disabled unless explicitly required, which fully removes the attack surface at the cost of losing GenAI tool integration. If MCP must remain enabled, set a non-empty mcp-query_endpoint_auth token before exposing /mcp/query (trade-off: every MCP caller must be reconfigured with the token), restrict the MCP listener to loopback or a management VLAN via firewall rules so only trusted agents can reach it, configure the MCP target MySQL credentials as a database-level read-only user with no DDL or administrative grants (limits blast radius even if the validator is bypassed), and add temporary ProxySQL query rules that reject inputs containing an unquoted ; followed by further non-whitespace content to block obvious multi-statement payloads (may break any legitimate batched queries).