dbhub vulnerabilities

2 known vulnerabilities in dbhub from Bytebase. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  dbhub: Incomplete List of Disallowed Inputs

  CVE-2026-61788Sep 24, 2026Bytebase

  DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_

• 9.3 Critical severity

  dbhub: Missing Authentication for Critical Functionality

  CVE-2026-61742Sep 24, 2026Bytebase

  DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The