THREAT OPS › Threat News › [GHSA] GHSA-rqfv-2mw9-78g2 (critical) — MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
[GHSA] GHSA-rqfv-2mw9-78g2 (critical) — MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
GHSA-rqfv-2mw9-78g2 Severity: critical CVE: CVE-2026-59971
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
## Summary
In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_settings`. As a result, the MCP Python SDK's DNS-rebinding protection (Origin/Host h
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-59971cve
Original source: https://github.com/advisories/GHSA-rqfv-2mw9-78g2