Bytebase
Monthly
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Read-only mode in Bytebase DBHub before 0.22.6 can be bypassed on the MySQL and MariaDB connectors, allowing write and destructive DDL statements such as DROP TABLE to reach the database through the MCP execute-SQL tool. The root cause is an interpretation conflict: DBHub's scanner treats every '--' as a line comment, while MySQL and MariaDB only start a comment when whitespace follows, so a payload like 'SELECT 1--1;DROP TABLE victim' passes the read-only classifier and is still executed in full because the connectors run with multipleStatements enabled. Unauthenticated remote attackers must be able to influence the SQL the assistant issues - most realistically via prompt injection in content the assistant reads - and read-only mode must actually be enabled for the bypass to matter; a proof-of-concept payload is documented in the public advisory, no confirmed public exploit code or CISA KEV entry exists at time of analysis, and the issue is fixed in 0.22.6.
Authenticated users in Bytebase before 3.16.0 can read task-run data belonging to projects they hold no permission on, because the rollout service handlers resolved tasks and task runs by UID alone without verifying they belonged to the project and plan named in the request. The practical result is cross-project disclosure of execution logs, database session details, and rollback SQL - a confidentiality-only issue with no write or availability impact, requiring a valid account with permission on at least one project. Bytebase 3.16.0 contains the fix (PR #19554); no public exploit code was identified and the flaw is not in CISA KEV, so this is a moderate-severity, this-month remediation item rather than an emergency, with the caveat that sequential integer UIDs make enumeration of foreign objects straightforward.
Bytebase before 3.16.0 contains an authorization bypass in the UpdateIssueComment handler that lets authenticated users with any project role, including Project Viewer, overwrite issue comments in projects they cannot access. The attacker supplies a comment UID from a foreign project while setting the parent to an issue in their own project, and the handler modifies the comment without verifying the parent-child relationship. The assessed impact is limited to comment integrity (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit was identified at time of analysis, and the vendor has released 3.16.0 as the fix.
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DBHub's `readonly = true` option on its `execute_sql` tool fails to enforce read-only database access in versions prior to 0.22.6, because the connector code that would set PostgreSQL `default_transaction_read_only=on` and open SQLite in read-only mode is gated on a configuration value that is never populated. With only a first-keyword classifier left as a guard, any `SELECT` that calls a side-effecting function passes, allowing sequence tampering with an ordinary role and, with a privileged PostgreSQL role, arbitrary host file write via `lo_export`, arbitrary host file read via `pg_read_file`, and remote code execution via `dblink` combined with `COPY ... TO PROGRAM`. The HTTP transport is unauthenticated (CVSS vector PR:N) and binds to `0.0.0.0` by default, so any network caller of `/mcp` can reach the vulnerable tool; CVSS is 7.4 (AV:N/AC:H) and no public exploit code has been identified at time of analysis, though the vendor-released patch 0.22.6 resolves the issue.
Unauthenticated MCP tool invocation in DBHub versions prior to 0.22.5 allows a malicious website to reach the HTTP transport endpoint and dispatch database tool calls against connected Postgres, MySQL, SQL Server, Oracle, MariaDB, or SQLite databases, because the server's Origin-equals-Host check is defeated by DNS rebinding. The flaw applies only when DBHub is launched in the non-default HTTP transport mode (for example --transport http --port 8080); the default stdio transport is unaffected, and exploitation requires a victim's browser to load attacker-controlled content and successfully complete the rebind window, per the independent assessment. No public exploit has been identified at time of analysis, and while the CVSS 4.0 vector scores 9.3, the assessed real-world severity is lower (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L), with impact bounded by DBHub's configured tool permissions and database credentials - read-only configurations limit exposure to disclosure.
Read-only mode in Bytebase DBHub before 0.22.6 can be bypassed on the MySQL and MariaDB connectors, allowing write and destructive DDL statements such as DROP TABLE to reach the database through the MCP execute-SQL tool. The root cause is an interpretation conflict: DBHub's scanner treats every '--' as a line comment, while MySQL and MariaDB only start a comment when whitespace follows, so a payload like 'SELECT 1--1;DROP TABLE victim' passes the read-only classifier and is still executed in full because the connectors run with multipleStatements enabled. Unauthenticated remote attackers must be able to influence the SQL the assistant issues - most realistically via prompt injection in content the assistant reads - and read-only mode must actually be enabled for the bypass to matter; a proof-of-concept payload is documented in the public advisory, no confirmed public exploit code or CISA KEV entry exists at time of analysis, and the issue is fixed in 0.22.6.
Authenticated users in Bytebase before 3.16.0 can read task-run data belonging to projects they hold no permission on, because the rollout service handlers resolved tasks and task runs by UID alone without verifying they belonged to the project and plan named in the request. The practical result is cross-project disclosure of execution logs, database session details, and rollback SQL - a confidentiality-only issue with no write or availability impact, requiring a valid account with permission on at least one project. Bytebase 3.16.0 contains the fix (PR #19554); no public exploit code was identified and the flaw is not in CISA KEV, so this is a moderate-severity, this-month remediation item rather than an emergency, with the caveat that sequential integer UIDs make enumeration of foreign objects straightforward.
Bytebase before 3.16.0 contains an authorization bypass in the UpdateIssueComment handler that lets authenticated users with any project role, including Project Viewer, overwrite issue comments in projects they cannot access. The attacker supplies a comment UID from a foreign project while setting the parent to an issue in their own project, and the handler modifies the comment without verifying the parent-child relationship. The assessed impact is limited to comment integrity (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no public exploit was identified at time of analysis, and the vendor has released 3.16.0 as the fix.
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.