Bytebase DBHub CVE-2026-61789

Requires DBHub prior to 0.22.6 connected via the MySQL or MariaDB connector (PostgreSQL is explicitly unaffected, and this path does not reach the Oracle/SQL Server/SQLite connectors), with read-only mode actually enabled - that is the control being bypassed. The MySQL/MariaDB connection pools run with multipleStatements:true (the connector default per the advisory), and execute-sql.ts validates the split statements with isReadOnlySQL but then sends the original unmodified string to the database. The attacker must be able to influence the SQL the assistant issues, most realistically through prompt injection in content the assistant reads. Limiting factors that reduce realistic risk: the destructive impact is bounded by the database account's privileges, exploitation depends on read-only mode being in use and on the assistant processing attacker-controlled content, and deployments using only PostgreSQL or the unaffected connectors are not exposed by this path.

The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N, base 6.1, medium) is internally consistent with the mechanism: network-reachable (AV:N), no authentication to the MCP layer in the realistic threat model (PR:N), but a precondition is Present (AT:P) because read-only mode must actually be in use and attacker-influenced content must reach the assistant, and user/agent interaction is passive (UI:P). Impact is confined to integrity and availability (VI:H/VA:H - arbitrary writes and destructive DDL such as DROP TABLE) with no added confidentiality loss (VC:N), since read access is already permitted in read-only mode. On the authorization-control severity this is genuinely high - read-only mode is the exact protection operators rely on when exposing a database to an AI agent, and the bypass defeats it - but several signals pull real-world urgency down to medium. The vuln.today decision label is 'this_month', not act_now/emergency. The vulnerability is NOT listed in CISA KEV (no confirmed active exploitation). No EPSS score was provided, so statistical exploitation probability is unknown and cannot be weighed. A detailed PoC is written out in the GHSA advisory, but the input does not mark it 'Publicly available (confirmed)', so it should be treated as a public PoC description, not verified working exploit code. Net: a real and credible authorization bypass whose practical reach is limited by narrow preconditions (MySQL/MariaDB connector + read-only mode + attacker-controlled SQL) and a small deployment footprint, rather than a mass-exploitation emergency.

An operator runs DBHub in read-only mode so an AI assistant can query a MySQL or MariaDB database safely, and an attacker plants instructions inside content the assistant later reads (a document, web page, ticket, or table row). Via prompt injection the assistant is steered to send a query such as 'SELECT 1--1;DROP TABLE victim'; DBHub's validator treats everything after '--' as a comment and approves a lone SELECT, but the connector runs the original string with multipleStatements enabled, so MySQL/MariaDB parse '1--1' as minus operators and then execute the stacked DROP. A public PoC description exists in the advisory; it is not verified as working exploit code.