mysql-mcp-server CVE-2026-59971

The server must be started with MCP_TRANSPORT=sse (the SSE/HTTP transport); the default stdio mode is not vulnerable. In that mode no further conditions apply for direct exposure - the service binds to 0.0.0.0 with no authentication and no Origin/Host validation on the /, /sse, and /messages/ routes, so any network-reachable attacker can call execute_sql. Limiting factors: SSE is not the default transport and must be explicitly enabled; escalation from SQL execution to host file read/write and RCE additionally requires the configured MySQL account to hold the FILE privilege; the DNS-rebinding variant (against a 127.0.0.1 bind) requires victim browser interaction with an attacker-controlled page.

The input CVSS is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), which correctly reflects unauthenticated network reach and full CIA impact in the vulnerable configuration; however, this base score does not capture the key limiter that the flaw only exists when the operator explicitly sets MCP_TRANSPORT=sse - the default stdio mode is not affected. I would assess Scope as Unchanged (the server is designed to reach its configured database), yielding roughly 9.8 rather than 10.0. No EPSS score, KEV entry, or SSVC decision data was provided; there is no public exploit identified at time of analysis, though the advisory documents concrete direct-exposure and DNS-rebinding attack paths and confirms 25 internet-exposed instances, indicating real but bounded exposure. Net: genuinely high severity where SSE is enabled and exposed, but the non-default transport requirement and small deployment footprint make it a targeted-scanning risk rather than a mass-exploitation event.

An attacker scans the internet for exposed SSE instances (25 already identified), connects to a reachable 0.0.0.0-bound server, and invokes execute_sql with no credentials to dump the full database; if the MySQL user has FILE privilege, they use INTO OUTFILE to drop a webshell and gain RCE on the host. Alternatively, for a loopback-bound instance, they lure the victim's browser to a malicious page and use DNS rebinding to reach 127.0.0.1 as same-origin and issue the same queries. No public exploit tool is published, but the advisory details both paths.