What happened
In DBHub < 0.22.6, setting readonly=true on the execute_sql tool does not make the connection read-only: the code that sets PostgreSQL default_transaction_read_only and SQLite readOnly mode is gated on a config value that is never populated, so only a keyword classifier remains. A privileged role can use SELECT-with-side-effects to write arbitrary files (lo_export), read arbitrary host files (pg_read_file) and achieve RCE (dblink + COPY ... TO PROGRAM). The HTTP transport is unauthenticated and binds to 0.0.0.0 by default. Fixed in 0.22.6.
Why it matters
The read-only isolation promise that defenders rely on for AI agents on a database is silently broken, and combined with the unauthenticated, all-interfaces HTTP transport, any network caller of /mcp can escalate to host file read/write and command execution on the DB server backing an AI agent's data access.
Attack vector
Unauthenticated SQL to the MCP endpoint; a side-effecting SELECT (or dblink/COPY TO PROGRAM chain) bypasses the readonly classifier to write files, read host files or run commands on the database server.
Affected systems
DBHub database MCP server < 0.22.6
Mitigation
Upgrade to DBHub 0.22.6+; restrict network exposure of the MCP HTTP transport; use non-privileged DB roles.