CVE-2026-61742

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue.

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue.

Summary

DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080.

The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.

As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials.

Recommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.

Details

Affected target:

• Package: @bytebase/dbhub
• Version tested: 0.21.2
• Repository commit tested: 72adfdcf7bcfe46b25edbc776ce096006eba9b02
• Affected mode: HTTP transport (--transport http)
• Default package transport: stdio
• Not affected by this specific browser-origin vector: stdio transport

Relevant code path: src/server.ts

The HTTP server installs a middleware that:

1. reads req.headers.origin;
2. extracts the hostname from req.headers.host;
3. parses the hostname from Origin;
4. rejects only when the two hostnames differ;
5. reflects the validated Origin into Access-Control-Allow-Origin;
6. enables credentials with Access-Control-Allow-Credentials: true.

Relevant code:

const origin = req.headers.origin;

if (origin) {
  const host = (req.headers.host ?? '').split(':')[0].toLowerCase();
  try {
    const originHost = new URL(origin).hostname.toLowerCase();
    if (originHost !== host) {
      return res.status(403).json({
        error: 'Forbidden',
        message: 'Origin does not match Host header (DNS rebinding protection)',
      });
    }
  } catch {
    return res.status(400).json({ error: 'Bad Request', message: 'Malformed Origin header' });
  }
}

res.header('Access-Control-Allow-Origin', origin || 'http://localhost');
res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type, Mcp-Session-Id');
res.header('Access-Control-Allow-Credentials', 'true');

This blocks a simple cross-origin request such as:

Host: localhost:8080
Origin: http://attacker.example

However, it accepts the DNS rebinding request shape:

Host: dbhub-rebind.example:8080
Origin: http://dbhub-rebind.example

In a browser attack, the victim visits an attacker-controlled page such as http://dbhub-rebind.example:8080. The attacker initially resolves that hostname to the attacker's web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.

No authorization token, per-server secret, or CSRF-style capability is required before /mcp accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.

Suggested remediation:

• Bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts.
• Add an explicit allowed-hosts policy instead of accepting…

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue.

Summary

DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080.

The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.

As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials.

Recommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.

Details

Affected target:

• Package: @bytebase/dbhub
• Version tested: 0.21.2
• Repository commit tested: 72adfdcf7bcfe46b25edbc776ce096006eba9b02
• Affected mode: HTTP transport (--transport http)
• Default package transport: stdio
• Not affected by this specific browser-origin vector: stdio transport

Relevant code path: src/server.ts

The HTTP server installs a middleware that:

1. reads req.headers.origin;
2. extracts the hostname from req.headers.host;
3. parses the hostname from Origin;
4. rejects only when the two hostnames differ;
5. reflects the validated Origin into Access-Control-Allow-Origin;
6. enables credentials with Access-Control-Allow-Credentials: true.

Relevant code:

const origin = req.headers.origin;

if (origin) {
  const host = (req.headers.host ?? '').split(':')[0].toLowerCase();
  try {
    const originHost = new URL(origin).hostname.toLowerCase();
    if (originHost !== host) {
      return res.status(403).json({
        error: 'Forbidden',
        message: 'Origin does not match Host header (DNS rebinding protection)',
      });
    }
  } catch {
    return res.status(400).json({ error: 'Bad Request', message: 'Malformed Origin header' });
  }
}

res.header('Access-Control-Allow-Origin', origin || 'http://localhost');
res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type, Mcp-Session-Id');
res.header('Access-Control-Allow-Credentials', 'true');

This blocks a simple cross-origin request such as:

Host: localhost:8080
Origin: http://attacker.example

However, it accepts the DNS rebinding request shape:

Host: dbhub-rebind.example:8080
Origin: http://dbhub-rebind.example

In a browser attack, the victim visits an attacker-controlled page such as http://dbhub-rebind.example:8080. The attacker initially resolves that hostname to the attacker's web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.

No authorization token, per-server secret, or CSRF-style capability is required before /mcp accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.

Suggested remediation:

• Bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts.
• Add an explicit allowed-hosts policy instead of accepting…