Unauthenticated MySQL MCP Server SSE Transport Allows Remote SQL Execution

Technical Analysis

The vulnerability stems from src/mysql_mcp_server/server.py constructing SseServerTransport without security_settings or enable_dns_rebinding_protection, combined with unauthenticated Starlette routes (/, /sse, /messages/) and a default bind to 0.0.0.0. This exposes the MCP tool-calling interface directly over the network without any identity or origin verification, allowing an attacker to call execute_sql with arbitrary SQL, or to leverage DNS rebinding to trick a victim's browser into relaying same-origin requests to a locally bound instance. The entry point is the MCP server's SSE/HTTP transport layer rather than the model or agent logic itself, meaning the AI reasoning is bypassed entirely — the attacker interacts with the tool execution boundary directly. The impact crosses from the MCP protocol layer into the underlying database and potentially the host OS if MySQL FILE privileges are enabled, turning a tool-invocation flaw into full data exfiltration, tampering, or remote code execution.

Affected Systems

MySQL MCP Server; protocols: MCP

Detection Signatures

• MCP server logs showing execute_sql calls from unexpected/external source IPs
• SSE transport enabled (MCP_TRANSPORT=sse) with server bound to 0.0.0.0 and no reverse-proxy auth in front
• HTTP requests to /sse or /messages/ endpoints without accompanying authentication headers or session tokens
• Unusual cross-origin requests to locally bound MCP ports (indicative of DNS rebinding attempts)
• MySQL query logs showing administrative or file-system related statements (e.g., LOAD_FILE, INTO OUTFILE) originating from the MCP service account

Remediation Steps

1. 1

   Upgrade to version 0.4.2 or later

   Apply the patched release which adds security_settings and DNS rebinding protection to the SSE transport.

2. 2

   Avoid SSE transport unless necessary

   Prefer the default stdio transport, which is unaffected, especially for local or single-user deployments.

3. 3

   Add authentication in front of SSE endpoints

   Place an authenticating reverse proxy or API gateway in front of /, /sse, and /messages/ routes if SSE transport must be used.

4. 4

   Bind to localhost, not 0.0.0.0

   Restrict the service to loopback interfaces or trusted internal networks unless remote access is explicitly required and secured.

5. 5

   Apply least-privilege database credentials

   Ensure the MySQL account used by the MCP server lacks FILE privileges and has minimal read/write scope to limit blast radius.

6. 6

   Enable DNS rebinding protections

   Validate Host headers and enforce allow-listed origins for any locally bound web-facing service.