What happened
DBHub (Bytebase's database MCP server for Postgres/MySQL/SQL Server/Oracle/MariaDB/SQLite) versions < 0.22.5 expose an unauthenticated HTTP MCP endpoint when run with the documented HTTP transport (--transport http --port 8080). The Origin-vs-Host hostname check is defeated by DNS rebinding, so a malicious website can deterministically invoke DBHub MCP tools (read/enumerate/write database contents) from the victim's browser with no prompt injection or model involvement. Fixed in 0.22.5. CISA SSVC marks exploitation 'poc', automatable 'yes', technical impact 'total'.
Why it matters
This is a novel agent-execution attack class against widely used MCP infrastructure: the MCP tool server itself is the vulnerable surface, reachable by any web page a victim visits. A database MCP server is typically granted broad SQL access, so browser-based DNS rebinding turns a single page view into database read/write - no AI model or prompt injection required.
Attack vector
Attacker-controlled domain rebinds to the victim-accessible DBHub HTTP server; malicious website then issues MCP tool calls (SQL queries) from the victim's browser without authentication.
Affected systems
DBHub database MCP server < 0.22.5 (HTTP transport mode)
Mitigation
Upgrade to DBHub 0.22.5 or later; do not expose the MCP HTTP endpoint to the network / bind to localhost where possible.