Bytebase DBHub CVE-2026-79536

Requires a reachable Bytebase DBHub v1.2.0 instance where the attacker can submit SQL through the MCP interface; the flaw is a failure in /utils/sql-parser.ts to safely parse/classify input, so a crafted SQL statement passes the parser and reaches the backend database. Per the vendor's I:H/A:H scoring, the practical gate is DBHub's read-only enforcement being bypassed, so the condition is specifically a parser-level control bypass rather than a configuration toggle. Limiting factors: exploitation depends on the DBHub MCP server being network-reachable by the attacker - DBHub is commonly run locally or behind a trusted MCP client, which can substantially reduce real-world exposure despite the AV:N/PR:N rating; only version 1.2.0 is confirmed affected.

The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) rates this Critical, but the signals are mixed and partly self-contradictory. The vector is network/no-auth/low-complexity, which is the worst case, yet it scores C:N/I:H/A:H - meaning the author modeled this as a bypass of DBHub's read-only enforcement (letting a crafted statement perform writes/deletes = integrity and availability loss) rather than data theft. That directly conflicts with the one-line description, which says the flaw 'allows attackers to access sensitive database information' - a confidentiality claim that would warrant C:H, not C:N. This contradiction must be verified against the vendor/traceforce advisory before trusting the exact impact profile. On exploitation likelihood, the signals are low-to-moderate: SSVC reports Exploitation=none (no observed exploitation), Automatable=yes, Technical Impact=partial - note that SSVC 'partial' technical impact is itself in tension with the I:H/A:H 'total' framing of the CVSS vector. No EPSS score, no CISA KEV listing, and no public POC were provided. The practical risk is further bounded by how DBHub is actually deployed: it is an MCP database-gateway server, frequently run locally or behind an MCP client rather than exposed to the open internet, so the PR:N/AV:N worst case may overstate real-world reachability. Net: this is a genuine SQL-injection/parser-bypass flaw worth patching, but the Critical score reflects theoretical worst-case reachability more than demonstrated widespread risk; it is not currently a drop-everything priority absent exploitation evidence.

An attacker who can reach a DBHub v1.2.0 MCP server submits a crafted SQL statement that evades the read-only / safety classification logic in /utils/sql-parser.ts. Because the parser fails to correctly reject or neutralize the input, the statement reaches the backend database, letting the attacker read sensitive data and (per the vendor's I:H/A:H scoring) potentially modify or destroy it despite intended read-only restrictions. No public exploit code was identified at the time of analysis, but the attack requires no special skill once the server is reachable.