What happened
MySQL MCP Server's SSE/HTTP transport mode omits the security settings needed to enforce Origin/Host validation, allowing unauthenticated remote SQL execution against the backing database directly or via DNS-rebinding attacks from a victim's browser.
Why it matters
MCP database servers are a common integration point for LLM agents needing structured-data access; an unauthenticated SQL execution primitive in this widely used connector — reachable either directly or by tricking a browser into rebinding DNS to the local MCP listener — gives attackers a path to full database compromise and, with elevated MySQL privileges, host-level code execution.
Attack vector
When MCP_TRANSPORT=sse is set, the server constructs SseServerTransport without security_settings or enable_dns_rebinding_protection, so the MCP Python SDK's Origin/Host validation is never applied. A remote, unauthenticated attacker (directly, or via DNS rebinding from a malicious web page) can submit SQL queries to the exposed MCP server; with sufficient MySQL permissions (e.g. FILE) this can escalate to arbitrary file read/write and potential RCE.
Affected systems
mysql-mcp-server (PyPI) prior to 0.4.2
Mitigation
Upgrade to mysql-mcp-server 0.4.2 or later, which enables DNS-rebinding/Origin-Host protection by default in SSE mode. Operators running SSE/HTTP-exposed MCP MySQL servers should verify they are not directly internet-reachable and are patched immediately given the CVSS 10.0 rating.