Unauthenticated SQL Execution and RCE in MySQL MCP Server via SSE Transport

The mysql_mcp_server package (prior to v0.4.2) contains a critical security vulnerability when configured to use the Server-Sent Events (SSE) transport mode. Due to the failure to instantiate SseServerTransport with security_settings, the application lacks essential protections, including DNS-rebinding prevention, CORS middleware, and TrustedHost validation. Furthermore, the application exposes unauthenticated endpoints (/, /sse, and /messages/) and binds to 0.0.0.0 by default.

An unauthenticated remote attacker can exploit this configuration to execute arbitrary SQL commands against the database backend. If the database user is configured with FILE privileges, this vulnerability enables arbitrary file read and write operations, which can be leveraged to achieve remote code execution by dropping a malicious web shell. Instances exposed to the internet are at high risk, as are local instances susceptible to browser-based DNS-rebinding attacks. 25 publicly reachable instances have already been identified.

Attack Chain

1. Attacker identifies an exposed MySQL MCP Server instance running with MCP_TRANSPORT=sse on a public interface (0.0.0.0).
2. Attacker sends an unauthenticated HTTP POST request to the /messages endpoint.
3. The request includes a JSON payload containing a malicious SQL query within the execute_sql tool call.
4. The server receives the request and, lacking authentication middleware, processes the tool call directly.
5. The application invokes cursor.execute(query) using the attacker-supplied, unsanitized SQL.
6. The database executes the query, returning results to the attacker or performing file system operations (e.g., INTO OUTFILE).
7. Attacker successfully achieves data exfiltration or writes a malicious payload to the host system.

Impact

Successful exploitation allows for full database exfiltration, modification, and potential system compromise. Attackers can leverage MySQL's FILE privileges to read sensitive files or write executable files (web shells) to the underlying server. Evidence suggests 25 publicly exposed instances are currently reachable, posing an immediate risk to environments utilizing this server for LLM-integrated database tasks.

Recommendation

1. Upgrade mysql_mcp_server to version 0.4.2 or later immediately to enable mandatory security settings.
2. Configure the server to bind to 127.0.0.1 rather than 0.0.0.0 if remote access is not required.
3. Ensure the database user assigned to the MCP server follows the principle of least privilege, specifically revoking FILE access if not strictly required.
4. Implement network-level access control (firewall or VPN) to restrict access to the SSE transport interface.