Daily Digest
The most urgent threat is CVE-2026-59971 in MySQL, a Critical (10.0) vulnerability in the MCP Server that allows unauthenticated network attackers to execute arbitrary SQL commands and modify database objects directly. This flaw is actively exploited in production environments and grants full database control without any authentication barrier, making it the highest priority remediation for the healthcare database fleet.
Summary: The MySQL MCP Server (version <0.4.2) constructs insecure SSE transports that lack authentication and DNS rebinding protection, exposing endpoints that allow unauthenticated clients to execute arbitrary `execute_sql` commands and modify database objects. An attacker can directly manipulate the configured database, read or write files, and even achieve code execution if FILE privileges exist. The vulnerability is fixed in version 0.4.2.
Affected Features / Interoperability: The MCP Server interface (`/`, `/sse`, `/messages`) lacks authentication on all routes and binds to `0.0.0.0`, enabling network-wide access to the underlying MySQL instance. Replication streams and client drivers are directly compromised through these endpoints.
Source: https://github.com/designcomputer/mysql_mcp_server/commit/a96549f4a4d65443fd6e9c7f2324fba9a5c80a82 https://github.com/designcomputer/mysql_mcp_server/issues/92 https://github.com/designcomputer/mysql_mcp_server/releases/tag/v0.4.2 https://github.com/designcomputer/mysql_mcp_server/security/advisories/GHSA-rqfv-2mw9-78g2
Actions:
Summary: The Anyquery SQL query engine (pre-0.4.5) sends unauthenticated MySQL traffic to an SQLite backend without proper attachment targeting, allowing remote attackers to write arbitrary files to the server filesystem and achieve RCE when combined with privileged processes.
Affected Features / Interoperability: Anyquery’s MySQL-compatible server port (v0.4.5+) exposes unattached SQLite virtual tables (`json_reader`, `log_reader`) to unauthenticated clients, enabling file system read/write and potential command execution.
Source: https://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c https://github.com/julien040/anyquery/releases/tag/0.4.5 https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx
Actions:
Summary: Anyquery’s pre-0.4.5 SQLite virtual table modules (`csv_reader`, `log_reader`) are exposed via unauthenticated MySQL ports without authentication or authorization, permitting remote attackers to probe internal APIs and leak cloud credentials.
Affected Features / Interoperability: The Anyquery server’s MySQL-compatible interface allows external entities to discover and query virtual tables that expose internal system information and credentials.
Source: https://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c https://github.com/julien040/anyquery/releases/tag/0.4.5 https://github.com/julien040/anyquery/security/advisories/GHSA-hwrq-8wxh-q4xv
Actions:
Summary: Warpgate (pre-0.25.6) exposes recording streams via an unauthenticated WebSocket endpoint that leaks real-time terminal input and output from SSH, MySQL, and PostgreSQL sessions, including credentials and sensitive data.
Affected Features / Interoperability: The `/recordings/{uuid}/stream` API is protected only by session authentication and lacks admin permission checks, allowing any authenticated user to intercept live session traffic.
Source: https://github.com/warp-tech/warpgate/commit/f5cb06ea09065f375870ccee64fe721a2ca79766 https://github.com/warp-tech/warpgate/releases/tag/v0.25.6 https://github.com/warp-tech/warpgate/security/advisories/GHSA-2q37-6vxr-26jr
Actions:
Summary: Anyquery (pre-0.4.5) exposes file-backed SQLite virtual tables (`csv_reader`, `log_reader`) through its MySQL-compatible server without authentication or directory restrictions, enabling remote attackers to read system configurations and private keys.
Affected Features / Interoperability: The Anyquery server’s MySQL port serves virtual tables that map to local filesystem paths, which an attacker can traverse to read sensitive files.
Source: https://github.com/julien040/anyquery/commit/27f84fc168310455eaf81ec4ba87eed20298670c https://github.com/julien040/anyquery/releases/tag/0.4.5 https://github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784
Actions:
Summary: DBHub (pre-0.22.6) fails to enforce read-only mode on the `execute_sql` tool despite PostgreSQL settings, allowing unauthenticated clients to run arbitrary SQL queries and potentially gain RCE via privileged roles.
Affected Features / Interoperability: The DBHub MCP server’s `execute_sql` tool is misconfigured, leaving database operations fully writable even when intended to be read-only.
Source: https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf
Actions:
Summary: The AdithyaYelloju Restaurant-Management-System (pre-7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) contains a SQL injection in the `mysqli_query` function of its bookmark reordering component, allowing remote attackers to execute arbitrary SQL commands.
Affected Features / Interoperability: The application’s web interface exposes an authenticated SQL injection vector that can compromise the entire database.
Source: https://github.com/AdithyaYelloju/Restaurant-Management-System/ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/5 https://vuldb.com/cve/CVE-2026-103229
Actions:
Summary: Another vulnerability in the same restaurant-management system (AdithyaYelloju) involving the `order_placement` component allows SQL injection via the `id/name` parameter, enabling remote code execution with privileged roles.
Affected Features / Interoperability: Similar to CVE-2026-103229, this flaw exists in the application’s web interface and can be exploited by any authenticated user with sufficient privileges.
Source: https://github.com/AdithyaYelloju/Restaurant-Management-System/ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/6 https://vuldb.com/cve/CVE-2026-103230
Actions:
Summary: The pgPointcloud extension (≤1.2.5) suffers from a heap out-of-bounds read in WKB deserialization, allowing authenticated users to read adjacent heap memory and potentially exfiltrate or crash the PostgreSQL backend.
Affected Features / Interoperability: The pgPointcloud extension handles spatial indexing; the vulnerability occurs during WKB patch processing, impacting any application using this extension.
Source: https://github.com/pgpointcloud/pointcloud/lib/pc_bytes.c#L1347-L1373 https://github.com/pgpointcloud/pointcloud/pull/388 https://www.vulncheck.com/advisories/pgpointcloud-through-1.2.5-heap-out-of-bounds-read-via-wkb-deserialization
Actions:
Summary: OpenObserve (pre-0.90.3) exposes unprotected configuration endpoints (`/config/runtime`) that return the complete PostgreSQL configuration, including DSN and credential strings, to unauthenticated clients.
Affected Features / Interoperability: The `/config/runtime` endpoint is meant for monitoring but lacks authentication, leaking sensitive deployment details.
Source: https://github.com/openobserve/openobserve/commit/4f3db1cf790ffe8ea065d98f87344e839ec6e477 https://github.com/openobserve/openobserve/releases/tag/v0.90.3 https://github.com/openobserve/openobserve/security/advisories/GHSA-v496-g5c9-vqxw
Actions:
Summary: DBHub (pre-0.22.6) has a read-only bypass where setting `readonly=true` on `execute_sql` does not enforce read-only mode, allowing remote attackers to execute arbitrary SQL and potentially achieve RCE.
Affected Features / Interoperability: The DBHub MCP server’s `execute_sql` tool is misconfigured, negating the intended read-only constraint.
Source: https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf
Actions:
Summary: Capgo (pre-12.261.0) has an incomplete access-control fix for the `public.sso_providers` table, allowing privilege escalation from `org_admin` to `org owner/super_admin` via manipulated `provider_id` values.
Affected Features / Interoperability: The SSO provider management table is a critical integration point for identity providers; the bug enables lateral movement within organizations.
Source: https://github.com/Cap-go/capgo.app/security/advisories/GHSA-jpjp-v827-j4gc https://www.vulncheck.com/advisories/capgo-sso-provider-id-authentication-bypass-via-incomplete-migration
Actions:
Summary: MobilityDB (≤1.3.0) has an out-of-bounds read in WKB deserialization that can crash the PostgreSQL backend when supplied with malformed WKB payloads containing negative length fields.
Affected Features / Interoperability: The MobilityDB extension’s WKB handling is vulnerable to buffer overflows leading to Denial of Service.
Source: https://github.com/MobilityDB/MobilityDB/releases/tag/v1.2.2 https://github.com/MobilityDB/MobilityDB/releases/tag/v1.3.1 https://github.com/MobilityDB/MobilityDB/security/advisories/GHSA-2c92-2w7c-pm3g
Actions:
Summary: MikroORM (pre-6.6.16, 7.1.7) has a missing validation of the `ORDER BY` direction in query builders, allowing raw SQL fragments to be executed and enabling data exfiltration or privilege escalation.
Affected Features / Interoperability: The ORM’s query construction pipeline fails to sanitize dynamic ordering clauses, leading to potential SQL injection across multiple database drivers.
Source: https://github.com/mikro-orm/mikro-orm/commit/3aba926fd07156f5e1ebf06294fd77ee1215bad5 https://github.com/mikro-orm/mikro-orm/pull/7996 https://github.com/mikro-orm/mikro-orm/releases/tag/v6.6.16
Actions:
Summary: n8n (pre-1.123.80, 2.0.0<2.39.6, 2.40.0<2.40.1) contains an SQL injection in the Oracle Database node’s `Delete Table Drop` operation, allowing attackers to execute arbitrary DDL/DML against the connected database.
Affected Features / Interoperability: The n8n integration with Oracle databases is vulnerable to injection via the Delete Table Drop endpoint, compromising the underlying Oracle instance.
Source: https://github.com/n8n-io/n8n/security/advisories/GHSA-4wf3-rgqr-xcp3 https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-sql-injection-via-oracle-database-drop-table
Actions:
Summary: DBHub (pre-0.22.5) has an unauthenticated HTTP MCP endpoint that can be abused via DNS rebinding to trigger MCP tool calls, potentially reading and writing database contents.
Affected Features / Interoperability: The DBHub MCP server’s HTTP transport mode is vulnerable to origin spoofing, enabling remote code execution through MCP tool invocation.
Source: https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w
Actions:
Summary: MikroORM (pre-6.6.16, 7.1.7) has a missing validation of the `orderBy` direction in query builders, similar to the PostgreSQL case, allowing raw SQL fragments to be executed.
Affected Features / Interoperability: The ORM’s query construction pipeline fails to sanitize dynamic ordering clauses, posing a risk across multiple database drivers.
Source: https://github.com/mikro-orm/mikro-orm/commit/3aba926fd07156f5e1ebf06294fd77ee1215bad5 https://github.com/mikro-orm/mikro-orm/pull/7997 https://github.com/mikro-orm/mikro-orm/releases/tag/v6.6.16
Actions:
Summary: Fumasoft Fumeng Cloud (pre-2023-10-18) contains a SQL injection in the `AjaxMethod.ashx` endpoint that allows unauthenticated remote attackers to inject arbitrary SQL and extract or modify database contents.
Affected Features / Interoperability: The Fumeng Cloud service exposes an unauthenticated API that can be leveraged for data exfiltration or database compromise.
Source: https://github.com/emadshanab/goby-poc/blob/main/fumengyun%20%20AjaxMethod.ashx%20SQL%20injection.json https://github.com/projectdiscovery/n
This week's most urgent item is CVE-2026-53988 (Dockhand, CVSS 10.0 CRITICAL), an unauthenticated remote code execution flaw allowing host compromise via attacker-controlled `docker-compose.yml` payloads through git webhook endpoints. No CISA KEV-confirmed entries were present in the provided feed to override severity-based prioritization, so the ranking below follows CVSS scores within each system. For our healthcare environment, the Barman backup integrity issue (CVE-2026-93853) is particularly relevant given our reliance on Postgres backups, and the Envoy Gateway file-read flaw (CVE-2026-53713) warrants review if we use Envoy for mTLS ingress. Several self-hosted DevOps tools (Tugtainer, Coolify, Obot) require immediate patching in both production and homelab contexts.
Summary: The Lokka Model Context Protocol server for Microsoft 365/Graph uses direct URL string concatenation to append user-controlled paths to the Azure management base URL. A crafted path can alter URL authority parsing, causing an Azure Resource Manager bearer token to be sent to an unintended host. This is fixed in version 2.1.2.
Affected Features / Interoperability: MCP server tooling (`src/mcp/src/main.ts`) used to query Microsoft Graph and Azure services. Token leakage could compromise downstream Azure resource access and any integrations relying on the Lokka MCP server.
Source:
Actions:
Summary: Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. Barman passes snapshot identifiers from `backup.info` to the cloud provider's delete API using Barman's own credentials without verifying ownership. Affected versions range from 3.4.0 (GCP), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0; fixed in Barman 3.20.1.
Affected Features / Interoperability: Barman snapshot backup deletion and retention policy enforcement. Downstream impact includes loss of cloud snapshots (AWS/Azure/GCP) used for Postgres disaster recovery and point-in-time recovery.
Source:
Actions:
Summary: A flaw in the `guardrails-detectors` component allows a remote attacker to perform blind SSRF by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to cloud metadata, Kubernetes API, internal MinIO, and other internal endpoints, plus local file reads of service account tokens and pod secrets.
Affected Features / Interoperability: Red Hat OpenShift AI `guardrails-detectors` component. Compromise could break cluster trust boundaries and expose secrets used by downstream workloads and integrations.
Source:
Actions:
Summary: Envoy Gateway's `to_absolute_normalized_path` in `security.lua` does not collapse redundant separators before path evaluation, allowing submitted Lua to read arbitrary files from the gateway controller pod. Exposed files can include Kubernetes service-account tokens, TLS certificates, and process environment data. Fixed in versions 1.7.4 and 1.8.1.
Affected Features / Interoperability: Envoy Gateway Lua validation (`EnvoyExtensionPolicy`) during Strict validation. Impacts mTLS certificate handling and gateway configuration security.
Source: