DBHub EUVD-2026-86320

Requires DBHub started in the non-default HTTP transport mode (--transport http --port 8080), which exposes the unauthenticated HTTP MCP endpoint; the default stdio transport is not affected. Exploitation further requires a victim with network/browser reachability to the DBHub host to load attacker-controlled web content, plus a successful DNS-rebinding window that defeats the Origin==Host check. Impact scope is bounded by DBHub's configured tool permissions and database credentials - read-only tool configs limit this to disclosure, while write-capable configs permit modification. These limiting factors (non-default mode, required browser interaction, rebind timing) substantially reduce realistic exploitability below the raw 9.3 score.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) presents this as a critical unauthenticated remote flaw, but the real-world risk is meaningfully lower and hinges on non-default deployment. Exploitation requires DBHub to be started in the documented but NON-default HTTP transport mode (--transport http), and the DNS-rebinding attack requires a victim with browser access to the DBHub host to visit an attacker-controlled site - i.e., meaningful user interaction and a timing/rebind window that the pure CVSS vector does not capture. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is a conflict between the vendor's PR:N/UI:N/AC:L scoring and the description's own limiting factors (browser interaction, DNS-rebind timing, and impact gated by 'configured tool permissions and database credentials'), which argues the practical severity is lower than 9.3 - closer to a high-complexity, user-interaction-required issue. Treat as a genuine but conditional priority: high impact where HTTP transport is exposed, negligible where the default stdio transport is used.

An operator runs DBHub with --transport http --port 8080 against a real configured database. A victim on the same network (or the operator themselves) visits an attacker-controlled website, which uses DNS rebinding to make its hostname resolve to the DBHub host; because both Origin and Host then contain the attacker hostname, DBHub's Origin==Host check passes and the page issues MCP tool calls from the victim's browser to read, enumerate, and potentially write database contents. No POC is present in the input and the flaw is not in CISA KEV, so this is no public exploit identified at time of analysis.