What happened
CVE-2026-85788 (CVSS 5.5, medium) affects Amazon awslabs mysql-mcp-server: an incomplete list of disallowed inputs in the mutable-SQL detector allows context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks by using SQL inline comments that the detector's regex engine does not treat as whitespace/statement separators, letting disallowed statements slip past the denylist.
Why it matters
This is a sibling flaw to the more severe postgres-mcp-server OS command injection disclosed the same week, showing a pattern across AWS's MCP database-server product line where regex/denylist-based read-only enforcement is insufficiently robust against SQL syntax edge cases. An LLM agent granted 'read-only' MySQL access through this MCP server could be manipulated (via prompt injection or a malicious query it is asked to run) into reading or writing arbitrary files on the database host.
Attack vector
Crafted SQL statement using inline comments to evade the mutable-SQL regex detector, allowing the read-only enforcement gate to be bypassed and reaching file-read/file-write SQL sinks.
Affected systems
Amazon awslabs mysql-mcp-server (version prior to fix)
Mitigation
Upgrade to the patched mysql-mcp-server version per AWS security bulletin; run the MCP server under a minimal-privilege MySQL role as defense in depth.