Bytebase vulnerabilities
We track 3 vulnerabilities in Bytebase products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Bytebase vulnerabilities
- 9.8 Critical severity
bytebase: Authentication Bypass by Spoofing
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST en
- 7.4 High severity
dbhub: Incomplete List of Disallowed Inputs
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_
- 9.3 Critical severity
dbhub: Missing Authentication for Critical Functionality
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The